Executive brief
Apache Camel's DAPR integration component is used to build data routing workflows that integrate with the DAPR distributed application runtime's pub/sub messaging system. A vulnerability in the component allows an attacker who can publish to a topic that a route subscribes to manipulate message routing, causing messages intended for one pub/sub destination to be redirected to an attacker-chosen destination, potentially exfiltrating sensitive data or bypassing access controls on broker topics.
Technical details
The vulnerability is an improper input validation (CWE-20) and confused deputy problem in the camel-dapr DaprPubSubConsumer. When consuming messages from a DAPR Pub/Sub topic, the component copies the inbound CloudEvent's pub/sub-name and topic fields directly into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These headers are producer-direction routing headers: when a route republishes a message through a DAPR producer endpoint, DaprConfigurationOptionsProxy reads and prefers these headers over the configured endpoint destination. An attacker with publish access to the subscribed topic can craft a CloudEvent with arbitrary pub/sub-name and topic values, causing the republished message to be delivered to any DAPR Pub/Sub component and topic of their choice instead of the configured destination. No authentication, privileges, or user interaction are required beyond the ability to publish to the source topic. This enables message redirection, exfiltration, and bypass of topic-level access controls.
Affected products
- Apache Camel 4.12.0 to 4.14.7, 4.15.0 to 4.18.2, 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-07: patched: Fixed in Camel 4.14.8, 4.18.3, and 4.21.0