Executive brief
Apache Camel-Knative is a component that routes messages via cloud events. When receiving events in structured JSON format, the component fails to filter Camel internal headers before copying them into message metadata. An attacker can inject malicious headers to redirect file operations or trigger server-side requests to unintended destinations, depending on how the application uses the message.
Technical details
The Knative consumer maps inbound CloudEvent attributes to Camel message headers. While binary content mode applies KnativeHttpHeaderFilterStrategy to filter internal headers from HTTP headers, structured content mode (Content-Type: application/cloudevents+json) reads CloudEvent extension fields directly from the JSON body and copies all extension keys into Exchange headers without any filtering. An unauthenticated attacker can send a structured-mode CloudEvent with crafted extension fields matching Camel-internal header names (case-insensitively matched) such as CamelHttpUri, CamelHttpPath, or CamelFileName. When a route forwards messages to header-driven components like camel-http or camel-file, the injected headers override configured values, enabling SSRF, path traversal, or redirection. Fixes are available in versions 4.14.9, 4.18.4, and 4.22.0.
Affected products
- Apache Camel 3.15.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x
- Apache Camel-Knative 3.15.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x
Timeline
- 2026-08-24: disclosed: CVE-2026-63621 published
- 2026: patched: Fixes released in versions 4.14.9, 4.18.4, and 4.22.0