CVE-2026-47323
Header Injection in Apache Camel CXF and Knative Components
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | camel | to 4.14.6 (exc) |
| apache | camel | to 4.18.2 (exc) |
| apache | camel | 4.19.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-178 | The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability involves message header injection in Apache Camel's CXF and Knative components due to missing inbound header filtering. Specifically, the implementations only filter outbound Camel-internal headers but do not filter inbound headers. As a result, an unauthenticated attacker can inject Camel-internal headers via HTTP requests to CXF-RS or CXF-SOAP endpoints.
When these injected headers are forwarded to header-driven components such as camel-exec or camel-file, they can override configured values. This can enable remote code execution or arbitrary file writes, posing a significant security risk.
How can this vulnerability impact me? :
The vulnerability allows an unauthenticated attacker to inject malicious headers that can override configuration in components like camel-exec or camel-file. This can lead to remote code execution or arbitrary file writes on the affected system.
Such impacts can compromise the integrity and security of your applications, potentially allowing attackers to execute arbitrary commands or manipulate files without authorization.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users are strongly advised to upgrade their Apache Camel installations to fixed versions.
- Upgrade to Apache Camel version 4.19.0 or later.
- If using the 4.18.x LTS release stream, upgrade to version 4.18.2 or later.
- If using the 4.14.x LTS release stream, upgrade to version 4.14.6 or later.