Authorization Bypass in Apache Camel Elasticsearch Rest Client

Impact Analysis

This vulnerability can allow an attacker to bypass authorization controls and manipulate Elasticsearch operations through specially crafted HTTP headers.

• Unauthorized access to all documents in an Elasticsearch index by using a match_all query.
• Deletion of documents by setting the OPERATION header to Delete along with an ID.
• Exfiltration of selected fields or sensitive data from Elasticsearch.

No credentials are required for these actions, making the impact significant for systems exposing the vulnerable component.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-46453 is a medium-severity vulnerability in Apache Camel's camel-elasticsearch-rest-client component caused by improper input validation and authorization bypass through user-controlled keys.

The component reads several Exchange headers like SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, and ID to control its behavior. These headers lack the usual 'Camel' prefix, so they bypass Camel's inbound HTTP header filtering, which only blocks headers starting with 'Camel' or 'camel'.

As a result, an untrusted HTTP client can directly set these headers in requests to override the configured Elasticsearch queries and operations, such as reading all documents, deleting documents, or exfiltrating data, without needing any credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to Apache Camel routes that expose an HTTP entry point in front of the elasticsearch-rest-client producer. Specifically, look for inbound HTTP requests containing the headers SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, or ID without the 'Camel' prefix.

You can use network monitoring or packet capture tools like tcpdump or Wireshark to filter HTTP headers for these specific header names.

• Using tcpdump to capture HTTP traffic and filter for suspicious headers: tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -iE 'SEARCH_QUERY|OPERATION|INDEX_NAME|INDEX_SETTINGS|ID'
• Using curl to test if the server accepts these headers: curl -v -H 'SEARCH_QUERY: {"match_all":{}}' http://your-camel-http-endpoint

Additionally, review application logs for unexpected operations or queries that could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Apache Camel to a fixed version: 4.14.8, 4.18.3, or 4.21.0 depending on your release stream.

If immediate upgrade is not possible, apply temporary mitigations by stripping the affected headers from untrusted inbound messages before they reach the elasticsearch-rest-client producer.

• Remove headers: removeHeader('SEARCH_QUERY'), removeHeader('OPERATION'), removeHeader('INDEX_NAME'), removeHeader('INDEX_SETTINGS'), and removeHeader('ID') in the Camel route before the elasticsearch-rest-client endpoint.
• Alternatively, implement a custom HeaderFilterStrategy that blocks these header names.

Useful 0 Not Useful 0