CVE-2026-78329: Apache Camel Undertow header filter bypass in endpoint routes

Executive brief

Apache Camel's Undertow component is used to integrate web services and messaging in enterprise applications. A configuration bug caused the endpoint to ignore the Undertow-specific header filtering rules, allowing attackers to inject malicious headers that could redirect WebSocket connections to unintended recipients or bypass security policies. This affects applications using Camel to route messages through Undertow endpoints without explicit header filtering configuration.

Technical details

The vulnerability is an improper input validation issue (CWE-20) in the UndertowEndpoint class. The root cause: UndertowEndpoint defaults its headerFilterStrategy field to the base HttpHeaderFilterStrategy and immediately overwrites the UndertowHeaderFilterStrategy that should be applied by DefaultUndertowHttpBinding, preventing Undertow-specific header filtering from executing on endpoint-configured routes. An unauthenticated remote attacker can send HTTP requests with crafted headers (specifically the legacy "websocket." prefixed headers) that are not filtered at the transport boundary. An undertow HTTP consumer maps these unfiltered inbound headers onto the Exchange message, where an undertow WebSocket producer reads them as dispatch directives, allowing the attacker to redirect WebSocket messages to peers other than those selected by the route. Additionally, header names that Undertow itself rejects are mapped onto the Exchange rather than being skipped, enabling header injection attacks. No authentication is required; the attack is exploitable over the network with low complexity. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0. Rest DSL consumers are not affected because they explicitly assign UndertowRestHeaderFilterStrategy.

Affected products

• Apache Camel 4.11.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x

Timeline

• 2026-08-24: disclosed: Vulnerability disclosed via GitHub Advisory GHSA-v7h8-xhh6-gfj4 and CVE-2026-78329
• 2026-08-24: patched: Patches released: version 4.14.9 (LTS), 4.18.4, and 4.22.0

References

• https://api.github.com/users/oscerd
• https://github.com/oscerd
• https://api.github.com/users/oscerd/gists%7B/gist_id%7D
• https://api.github.com/users/oscerd/repos
• https://avatars.githubusercontent.com/u/5106647?v=4
• https://api.github.com/users/oscerd/events%7B/privacy%7D