CVE-2026-85312
Received Received - Intake

Improper Input Validation in Apache Camel

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders("Long-Running-Action") on every consumer that accepts messages from an untrusted sender.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85312
EUVD
EUVD-2026-104200

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Improper Input Validation vulnerability in Apache Camel Core. It involves the saga processor using a header named Long-Running-Action to assign exchanges to sagas. The header lacks a Camel prefix, allowing external senders to set it on inbound messages. This lets attackers attach their requests to existing sagas or trigger incorrect compensations.

Detection Guidance

Detect this vulnerability by checking Apache Camel versions in use. Run commands like 'camel --version' or inspect application logs for Camel dependencies. Look for deployments using LRA sagas with untrusted message sources.

Impact Analysis

An attacker could manipulate saga assignments, causing unauthorized access to long-running actions or incorrect compensation logic. This may lead to data corruption, unauthorized transactions, or service disruptions in systems using Apache Camel with saga functionality.

Compliance Impact

This vulnerability could lead to unauthorized data access or processing, violating GDPR's integrity and confidentiality principles or HIPAA's access controls. Compliance may be compromised if unauthorized saga actions occur, potentially exposing sensitive data.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0 or apply patches: 4.18.5 for 4.18.x LTS or 4.22.1 for 4.22.x LTS. As a temporary fix, strip the 'Long-Running-Action' header at network boundaries using removeHeaders('Long-Running-Action') on untrusted message consumers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart