CVE-2026-47323
Description
Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering
The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code execution or arbitrary file writes. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177), the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891), and non-HTTP strategies (CVE-2026-40453).
This issue affects Apache Camel: from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2.
Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.2. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Missing inbound header filtering in Camel-CXF and Camel-Knative allows unauthenticated attackers to inject internal headers, leading to RCE or arbitrary file writes.
Vulnerability
The CxfRsHeaderFilterStrategy, CxfHeaderFilterStrategy, and KnativeHttpHeaderFilterStrategy implementations in Apache Camel (camel-cxf-rest, camel-cxf-transport, and camel-knative-http) fail to filter inbound Camel-internal headers via setInFilterStartsWith. This affects versions from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2, and from 4.19.0 before 4.19.0 [1]. An unauthenticated attacker can inject Camel-internal headers (e.g., CamelExecCommandExecutable, CamelFileName) through HTTP requests to CXF-RS or CXF-SOAP endpoints.
Exploitation
An attacker sends a crafted HTTP request to a vulnerable CXF-RS or CXF-SOAP endpoint, including header names like CamelExecCommandExecutable or CamelFileName. No authentication is required. If the route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling the attacker to control the executed command or file path.
Impact
Successful exploitation allows an unauthenticated attacker to achieve remote code execution via the camel-exec component or arbitrary file writes via the camel-file component. This compromises the confidentiality, integrity, and availability of the system, potentially leading to full server compromise.
Mitigation
Users should upgrade to version 4.19.0 (or 4.18.2 for 4.18.x LTS, or 4.14.6 for 4.14.x LTS) as recommended in the advisory [1]. No workaround is provided.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.