Executive brief
Apache Camel's Kafka component allows HTTP clients to inject unfiltered headers that override the configured message topic at runtime. In routes that bridge an HTTP consumer to a Kafka producer, an attacker can set the kafka.OVERRIDE_TOPIC header to redirect messages to arbitrary Kafka topics—including sensitive internal topics or those consumed by critical services—without requiring any credentials. Related headers can backdate messages or target specific partitions, enabling message injection attacks.
Technical details
The camel-kafka producer reads the kafka.OVERRIDE_TOPIC Exchange header from KafkaProducer.evaluateTopic() and uses it in preference to the endpoint-configured topic. The KafkaConstants class defines Kafka control headers using plain "kafka.*" names instead of Camel-prefixed names (e.g., CamelKafkaOverrideTopic). While KafkaHeaderFilterStrategy does filter kafka.* headers at the Kafka-to-Exchange boundary, it does not apply to headers arriving from upstream consumers. The upstream HTTP consumer (e.g., platform-http) uses HttpHeaderFilterStrategy, which only blocks Camel/camel namespace headers, allowing kafka.* headers to pass through unfiltered. In a bridged route from HTTP to Kafka, any unauthenticated HTTP client can inject kafka.OVERRIDE_TOPIC, kafka.OVERRIDE_TIMESTAMP, and kafka.PARTITION_KEY headers to redirect messages, backdate them, or target specific partitions. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0 and higher. Mitigation for unpatched systems includes stripping kafka.* headers from untrusted ingress.
Affected products
- Apache Camel 4.0.0 to 4.14.7; 4.15.0 to 4.18.2; 4.19.0 to 4.20.x
Timeline
- 2026-07-06: disclosed: CVE-2026-49098 published
- 2026-07-06: patched: Patches released in 4.14.8, 4.18.3, 4.21.0