Authorization Bypass in Apache Camel Lucene Component

Executive Summary

CVE-2026-46585 is a medium-severity security vulnerability in the Apache Camel camel-lucene component. It arises because certain HTTP headers (QUERY and RETURN_LUCENE_DOCS) that do not start with the Camel prefix bypass the HTTP header filter. This allows an attacker to inject unauthorized full-text search queries by setting these headers in HTTP requests to routes exposing Lucene operations. As a result, unauthorized queries can be executed against the full-text index, potentially exposing documents that should be restricted or allowing expensive queries that consume significant CPU resources. No authentication is required if the HTTP consumer is unauthenticated.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access to sensitive documents indexed by the Lucene component, bypassing intended access controls or filters. An attacker can execute arbitrary search queries, including match-all queries that return the entire index, exposing data that should remain confidential. Additionally, attackers can run resource-intensive regular-expression queries that may degrade system performance by consuming excessive CPU resources. Since no credentials are required when the HTTP consumer is unauthenticated, this can lead to data leakage and denial-of-service conditions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to Apache Camel routes that expose Lucene query operations via HTTP consumers (such as platform-http). Specifically, look for inbound HTTP requests containing the headers QUERY or RETURN_LUCENE_DOCS, which are not Camel-prefixed and can be used to inject unauthorized Lucene queries.

To detect exploitation attempts, you can inspect HTTP traffic or logs for these headers. For example, using command-line tools like curl or tcpdump to capture and analyze HTTP headers, or using grep to search logs for these header names.

• Use tcpdump or tshark to capture HTTP traffic and filter for QUERY or RETURN_LUCENE_DOCS headers.
• Example tcpdump command: tcpdump -A -s 0 'tcp port 80 or tcp port 8080' | grep -i 'QUERY:'
• Search application logs for occurrences of QUERY or RETURN_LUCENE_DOCS headers using grep: grep -i 'QUERY' /path/to/logs/*
• Use curl to manually test if the server accepts these headers: curl -v -H 'QUERY: test' http://your-camel-route

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Apache Camel to a fixed version: 4.14.8, 4.18.3, or 4.21.0 depending on your release stream.

If immediate upgrade is not possible, implement a workaround by stripping the attacker-controllable headers QUERY and RETURN_LUCENE_DOCS before the Lucene producer in your route, and set the query from a trusted source.

• Remove the QUERY and RETURN_LUCENE_DOCS headers at the start of the route using removeHeader('QUERY') and removeHeader('RETURN_LUCENE_DOCS').
• Set the QUERY header to a constant or trusted value using setHeader('QUERY', constant(...)).

After upgrading, update routes to use the new Camel-prefixed headers CamelLuceneQuery and CamelLuceneReturnLuceneDocs instead of QUERY and RETURN_LUCENE_DOCS to ensure proper filtering.

Useful 0 Not Useful 0