Improper input validation in Apache Camel
Priority MEDIUM 41CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00692 53rd percentileScored 2026-11-07
Fix Fixed org.apache.camel:camel-couchbase (Maven): 4.14.8, 4.18.3, 4.21.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | up to 4.14.7; 4.15.0 – 4.18.2; 4.19.0 – 4.20.0 | — | No fix listed | CNA |
| — | org.apache.camel:camel-couchbase (Maven) | 4.0.0 to before 4.14.8 | 4.14.8 | Patch available | GHSA-46jf-c9vx-hh79 |
| — | org.apache.camel:camel-couchbase (Maven) | 4.15.0 to before 4.18.3 | 4.18.3 | Patch available | GHSA-46jf-c9vx-hh79 |
| — | org.apache.camel:camel-couchbase (Maven) | 4.19.0 to before 4.21.0 | 4.21.0 | Patch available | GHSA-46jf-c9vx-hh79 |
- Apache Camel VendorApache Affected up to 4.14.7; 4.15.0 – 4.18.2; 4.19.0 – 4.20.0 Fixed in — No fix listed CNA
- org.apache.camel:camel-couchbase (Maven) Vendor— Affected 4.0.0 to before 4.14.8 Fixed in 4.14.8 Patch available GHSA-46jf-c9vx-hh79
- org.apache.camel:camel-couchbase (Maven) Vendor— Affected 4.15.0 to before 4.18.3 Fixed in 4.18.3 Patch available GHSA-46jf-c9vx-hh79
- org.apache.camel:camel-couchbase (Maven) Vendor— Affected 4.19.0 to before 4.21.0 Fixed in 4.21.0 Patch available GHSA-46jf-c9vx-hh79
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* | 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.14.8; 4.15.0 to before 4.18.3; 4.19.0 to before 4.21.0 Vulnerable ·Apache
Remediation
- Fix · GHSA-46jf-c9vx-hh79 org.apache.camel:camel-couchbase (Maven) Fixed in 4.14.8 Advisory →
- Fix · GHSA-46jf-c9vx-hh79 org.apache.camel:camel-couchbase (Maven) Fixed in 4.18.3 Advisory →
- Fix · GHSA-46jf-c9vx-hh79 org.apache.camel:camel-couchbase (Maven) Fixed in 4.21.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46587
- 2026-10-03 Alias added: GHSA-46jf-c9vx-hh79
References
Advisory 2
Other 10
- https://github.com/apache/camel/pull/23228
- https://github.com/apache/camel/pull/23230
- https://github.com/apache/camel/pull/23231
- https://github.com/apache/camel/commit/8d74cdca9befc74b49d9c52ac6a145be1d413e7d
- https://github.com/apache/camel/commit/c16f7ef39849ae8819f50c959b538350b8f839e9
- https://github.com/apache/camel/commit/d0dfa4e0ebd062acaf4a86ca476bb4305db9bfd4
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.8
- https://github.com/apache/camel/releases/tag/camel-4.18.3
- https://github.com/apache/camel/releases/tag/camel-4.21.0
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-46587 · CVE Program
- CVE-2026-46587 · NVD
- FIRST EPSS
- GHSA-46jf-c9vx-hh79 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences