Server-Side Request Forgery in Apache Camel Vertx Websocket

Executive Summary

CVE-2026-46726 is a vulnerability in the Apache Camel camel-vertx-websocket component where inbound WebSocket query and path parameters are mapped into the Camel Exchange header map without proper filtering. This allows an attacker to inject Camel-internal control headers, such as CamelHttpUri, by supplying them as query parameters.

Because these headers are not blocked, an attacker can manipulate server-side HTTP requests to redirect them to arbitrary destinations, including internal services or cloud metadata endpoints, resulting in server-side request forgery (SSRF).

Additionally, the HTTP producer resolves property placeholders in the attacker-controlled URI, which can expose sensitive information like environment variables, application properties, and vault secrets to the attacker.

This vulnerability affects Apache Camel versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0. The root cause is the lack of a HeaderFilterStrategy that filters Camel headers during inbound mapping.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an unauthenticated remote attacker to perform server-side request forgery (SSRF), redirecting server-side HTTP requests to attacker-chosen destinations, including internal services or cloud metadata endpoints.

It can also lead to exposure of sensitive information such as environment variables, application properties, and vault secrets because the HTTP producer resolves property placeholders in the attacker-controlled URI.

If the WebSocket endpoint is exposed without authentication, the attacker can exploit this vulnerability remotely without any credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring WebSocket endpoints for incoming query or path parameters that include Camel-internal control headers such as CamelHttpUri or headers starting with Camel* or camel*. An attacker may exploit this by sending specially crafted WebSocket requests with these headers as query parameters.

To detect potential exploitation attempts, you can inspect WebSocket traffic for suspicious query parameters or headers that attempt to inject Camel control headers.

While no specific commands are provided in the resources, general detection steps include:

• Capture and analyze WebSocket traffic using tools like Wireshark or tcpdump to look for query parameters containing Camel* or camel* headers.
• Use application logs to identify WebSocket requests that include unexpected headers or query parameters that map to Camel internal headers.
• If you have access to the Camel routes, add logging or debugging to inspect inbound WebSocket headers for presence of Camel control headers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Apache Camel to a fixed version: 4.21.0, 4.18.3, or 4.14.8 depending on your release stream.

If upgrading is not immediately possible, apply the following workarounds:

• Strip Camel control headers from inbound WebSocket messages before they reach any downstream HTTP producer by removing headers matching 'Camel*' and 'camel*' at the start of the route.
• Require authentication on the WebSocket endpoint to prevent unauthenticated remote attackers from exploiting the vulnerability.
• Avoid bridging an untrusted WebSocket consumer directly into an HTTP producer whose target URI can be controlled via message headers.

Useful 0 Not Useful 0