Improper input validation in Apache Camel
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules configured (NatsConfiguration). With no inFilter, inFilterPattern or inFilterStartsWith set, DefaultHeaderFilterStrategy.applyFilterToExternalHeaders returns not filtered for every header name, so NatsConsumer copies every NATS message header - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelSqlQuery - unmodified onto the Camel message. A client able to publish to the consumed NATS subject can therefore inject arbitrary Camel control headers that influence the behaviour of downstream producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a query); the injected headers also persist across internal direct, seda and vm hops. The concrete downstream impact depends on which producers the route uses. NATS message headers require NATS 2.2 or later, and the issue is reachable without credentials when the NATS server is configured without authentication (the NATS server default). This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes camel-nats default to a dedicated NatsHeaderFilterStrategy that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that cannot upgrade immediately, strip the Camel control headers from inbound NATS messages before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), and enable authentication on the NATS server so that only trusted clients can publish to the consumed subject.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 | 4.14.8, 4.18.3, 4.21.0 | Patch available | CNA |
| — | org.apache.camel:camel-nats (Maven) | 4.0.0 to before 4.14.8 | 4.14.8 | Patch available | GHSA-7v55-q9x3-83cj |
| — | org.apache.camel:camel-nats (Maven) | 4.15.0 to before 4.18.3 | 4.18.3 | Patch available | GHSA-7v55-q9x3-83cj |
| — | org.apache.camel:camel-nats (Maven) | 4.19.0 to before 4.21.0 | 4.21.0 | Patch available | GHSA-7v55-q9x3-83cj |
- Apache Camel VendorApache Affected 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Fixed in 4.14.8, 4.18.3, 4.21.0 Patch available CNA
- org.apache.camel:camel-nats (Maven) Vendor— Affected 4.0.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-7v55-q9x3-83cj
- org.apache.camel:camel-nats (Maven) Vendor— Affected 4.15.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-7v55-q9x3-83cj
- org.apache.camel:camel-nats (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-7v55-q9x3-83cj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Camel (Apache Software Foundation) Fixed in 4.14.8, 4.18.3, 4.21.0
- Fix · GHSA-7v55-q9x3-83cj org.apache.camel:camel-nats (Maven) Fixed in 4.14.8 Advisory →
- Fix · GHSA-7v55-q9x3-83cj org.apache.camel:camel-nats (Maven) Fixed in 4.18.3 Advisory →
- Fix · GHSA-7v55-q9x3-83cj org.apache.camel:camel-nats (Maven) Fixed in 4.21.0 Advisory →
Red Hat 1 advisory
- RHSA-2026:71675 Released 2026-09-24 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.4 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache Camel 4.14.8, 4.18.3, 4.21.0
14 records Highest priority Priority MEDIUM 7 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-35614 Improper input validation in Apache CamelPriority MEDIUM 50
- TI-2026-34159 Improper input validation in Apache CamelPriority MEDIUM 50
- TI-2026-34157 Improper input validation in Apache CamelPriority MEDIUM 50
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16 | Fixed | RHSA-2026:71675 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46457
- 2026-10-03 Alias added: GHSA-7v55-q9x3-83cj
- 2026-10-09 EPSS moved to the 50th–90th percentile
References
Advisory 3
Other 11
- https://github.com/apache/camel/pull/23233
- https://github.com/apache/camel/pull/23250
- https://github.com/apache/camel/pull/23255
- https://github.com/apache/camel/commit/67f7ea7465a1bf637339975c69a82327890e22f0
- https://github.com/apache/camel/commit/be8aad96fa04f81d2b58884e27ba6755c9ad2718
- https://github.com/apache/camel/commit/f7022926ca9c1c94866bf32596c9869f424a3b2c
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
- https://issues.apache.org/jira/browse/CAMEL-23515
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-46457 · CVE Program
- CVE-2026-46457 · NVD
- FIRST EPSS
- GHSA-7v55-q9x3-83cj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-46457 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences