Executive brief
Apache Camel's JIRA integration component allows unauthenticated attackers to inject HTTP headers that override JIRA operation parameters (issue keys, project keys, transition IDs, etc.) when a route bridges an HTTP consumer into a JIRA producer. An attacker can perform arbitrary JIRA operations using the configured service account's credentials, such as deleting issues, creating tickets in unintended projects, or modifying issue fields—without needing to authenticate or compromise credentials.
Technical details
This vulnerability is an improper input validation and authorization bypass (CWE-20, CWE-639) in the camel-jira component. The root cause is that JiraConstants header names (IssueKey, ProjectKey, IssueTransitionId, etc.) are not prefixed with "Camel/" or "camel_", so they bypass the HttpHeaderFilterStrategy's Camel-namespace filtering. When an HTTP consumer (e.g., platform-http) routes messages to a jira: producer, untrusted HTTP headers pass directly into the Exchange and override the intended JIRA operation parameters. The attack requires only network access to the HTTP endpoint; no authentication is needed if the consumer is unauthenticated. Attackers can leverage the service account's permissions to manipulate JIRA state. Fixed in versions 4.14.8 (4.14.x LTS), 4.18.3 (4.18.x), and 4.21.0 (4.19+); affected versions are 4.0.0–4.14.7, 4.15.0–4.18.2, and 4.19.0–4.20.x. Workaround: strip untrusted camel-jira control headers at the route entry point.
Affected products
- Apache Camel 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-07-06: patched: Patches released: version 4.14.8, 4.18.3, 4.21.0