SB20260824128 - Multiple vulnerabilities in Apache Camel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824128

SB20260824128 - Multiple vulnerabilities in Apache Camel

Published: August 24, 2026 Updated: August 25, 2026

Security Bulletin ID SB20260824128
CSH Severity
High
Patch available
YES
Number of vulnerabilities 34
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 24% Medium 65% Low 12%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 34 vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-40859)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in VertxHttpHelper.deserializeJavaObjectFromStream when processing a backend HTTP response with a 5xx status and the Content-Type application/x-java-serialized-object while transferException is enabled. A remote attacker can return a crafted serialized Java object to execute arbitrary code.

Exploitation requires control of the backend service or a man-in-the-middle position on an unencrypted connection, and a suitable gadget chain must be present on the classpath.


2) Input validation error (CVE-ID: CVE-2026-46584)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in the Camel Mail producer when processing attacker-controlled mail.smtp.* or mail.smtps.* message headers from untrusted input. A remote attacker can send crafted headers through an upstream protocol or message source to disclose sensitive information.

Exploitation requires a route that forwards untrusted input to an smtp or smtps producer without stripping the affected header namespace.


3) Input validation error (CVE-ID: CVE-2026-46457)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject Camel control headers into downstream message processing.

The vulnerability exists due to improper input validation in the camel-nats component when mapping inbound NATS message headers into the Camel Exchange. A remote attacker can publish a specially crafted message with arbitrary headers to inject Camel control headers into downstream message processing.

NATS message headers require NATS 2.2 or later, and injected headers can persist across internal direct, seda, and vm hops.


4) Input validation error (CVE-ID: CVE-2026-46456)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject Camel control headers and influence the behavior of downstream producers.

The vulnerability exists due to improper input validation in the camel-aws2-sqs component header filtering logic when mapping inbound SQS message attributes into the Camel Exchange. A remote user can send a specially crafted SQS message with arbitrary message attributes to inject Camel control headers and influence the behavior of downstream producers.

The injected headers can persist across internal direct, seda, and vm hops, and the specific downstream effect depends on which producers the route uses.


5) Insufficient Session Expiration (CVE-ID: CVE-2026-46455)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass token expiration checks.

The vulnerability exists due to improper access control in KeycloakSecurityHelper.parseAndVerifyAccessToken when verifying access tokens. A remote attacker can present an expired or not-yet-valid token to bypass token expiration checks.

Routes that rely on this helper to authenticate inbound requests are affected.


6) Input validation error (CVE-ID: CVE-2026-46454)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject Camel control headers.

The vulnerability exists due to improper input validation in CometdBinding.populateExchangeFromMessage when processing inbound Bayeux messages. A remote attacker can send a specially crafted CometD message with a malicious ext.CamelHeaders map to inject Camel control headers.

The issue is exposed because no Bayeux SecurityPolicy is installed by default, and the injected headers can persist across internal direct, seda, and vm hops.


7) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-46453)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to override the Elasticsearch query and operation.

The vulnerability exists due to improper input validation in the camel-elasticsearch-rest-client component when handling inbound HTTP headers. A remote attacker can send a specially crafted request with unprefixed header names to override the Elasticsearch query and operation.

The issue occurs when a Camel route exposes an HTTP entry point in front of an elasticsearch-rest-client producer, and no credentials are required.


8) Deserialization of Untrusted Data (CVE-ID: CVE-2026-43865)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in the camel-hazelcast component when processing serialized objects received over the Hazelcast cluster protocol. A remote attacker can publish a crafted serialized Java object to execute arbitrary code.

The issue is exposed by default when Camel creates and manages the Hazelcast instance from its own default configuration rather than using a user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean.


9) Deserialization of Untrusted Data (CVE-ID: CVE-2026-42527)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to deserialization of untrusted data in the ObjectInputFilter-based deserialization handling of affected Camel consumers when processing attacker-supplied Java-serialized payloads. A remote attacker can send a specially crafted serialized object containing java.net.URL keys to disclose sensitive information.

The issue can trigger outbound DNS queries to an attacker-controlled host as a deserialization side effect, creating an out-of-band information disclosure channel. Exposure is highest in the camel-jms family when ObjectMessage payloads are deserialized with the default mapJmsMessage setting enabled.


10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-46585)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper input validation and authorization bypass through user-controlled key in the Camel Lucene component when handling inbound HTTP requests to a route that exposes a Lucene query operation. A remote attacker can send a specially crafted HTTP request with QUERY or RETURN_LUCENE_DOCS headers to disclose sensitive information and cause a denial of service.

Unauthenticated exploitation is possible when the HTTP consumer is not protected by authentication.


11) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2026-40047)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject unintended command-line arguments and perform path traversal.

The vulnerability exists due to improper neutralization of argument delimiters in a command and insufficient path validation in DoclingProducer when processing externally influenced custom CLI arguments and path-bearing headers. A remote attacker can supply crafted header values to inject unintended arguments and perform path traversal.

The issue applies when a Camel route forwards externally influenced data into the CamelDoclingCustomArguments header or path-bearing headers used to build the docling invocation.


12) Deserialization of Untrusted Data (CVE-ID: CVE-2026-43866)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject arbitrary Exchange state.

The vulnerability exists due to deserialization of untrusted data in JmsBinding.extractBodyFromJms() and DefaultExchangeHolder handling when processing an incoming JMS ObjectMessage with mapJmsMessage enabled while Camel acts as a JMS consumer. A remote user can publish a specially crafted ObjectMessage to inject arbitrary Exchange state.

No deserialization gadget chain is required, and the injected state can include the message body, headers, exchange properties, variables, exchange id, and exception.


13) Deserialization of Untrusted Data (CVE-ID: CVE-2026-43867)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() when deserializing persisted key metadata from the configured AWS Secrets Manager secret. A remote user can store a crafted serialized object in the secret to execute arbitrary code.

The unsafe object deserialization occurs before the returned object is checked and cast to KeyMetadata.


14) Input validation error (CVE-ID: CVE-2026-46587)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to override Couchbase operations.

The vulnerability exists due to improper input validation in the Couchbase component when processing non-Camel-prefixed Exchange headers from untrusted input. A remote attacker can supply crafted headers to override Couchbase operations.


15) Input validation error (CVE-ID: CVE-2026-46588)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to override the requested CouchDB operation.

The vulnerability exists due to improper input validation in the CouchDB component when processing non-Camel-prefixed Exchange headers from untrusted input. A remote attacker can supply crafted headers to override the operation and override the requested CouchDB operation.


16) Input validation error (CVE-ID: CVE-2026-49042)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate tool argument headers.

The vulnerability exists due to improper input validation in langchain4j-tools when processing tool argument headers against declared parameters. A remote attacker can send crafted header values to manipulate tool argument headers.


17) Deserialization of Untrusted Data (CVE-ID: CVE-2026-40048)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to unsafe deserialization in the FileBasedKeyLifecycleManager class when deserializing the contents of <keyId>.key files in the configured key directory. A local user can place a crafted serialized Java object in the key directory to execute arbitrary code.

Exploitation requires the ability to write to the key directory used by the application, and code execution occurs during normal key lifecycle operations before the deserialized object is type-checked.


18) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-48206)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform arbitrary JIRA issue operations using the endpoint's configured credentials.

The vulnerability exists due to authorization bypass through user-controlled key and improper input validation in the Camel JIRA component header handling when bridging an inbound HTTP request to a jira producer. A remote attacker can send specially crafted HTTP headers to perform arbitrary JIRA issue operations using the endpoint's configured credentials.

The issue occurs because non-Camel-prefixed Exchange header constants can pass through the HTTP header filter and override route-intended JIRA operation parameters. Exploitation is possible when an HTTP consumer is bridged to a jira producer, and no credentials are required if the bridging consumer is unauthenticated.


19) Input validation error (CVE-ID: CVE-2026-55994)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to improper input validation in the Camel-Iggy inbound consumer header mapping when processing externally supplied Iggy message user-headers. A remote user can publish a specially crafted message with Camel control headers to perform server-side request forgery and disclose sensitive information.

Exploitation requires the ability to publish to the consumed Iggy stream or topic and a route in which the consumer feeds a downstream HTTP producer.


20) Input validation error (CVE-ID: CVE-2026-55993)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to improper input validation in the Camel-Atmosphere-Websocket inbound consumer when processing externally supplied WebSocket query parameters. A remote attacker can supply crafted query parameters that inject Camel control headers to perform server-side request forgery and disclose sensitive information.

Exploitation requires a route where the WebSocket consumer feeds a downstream HTTP producer, and property placeholders in the attacker-controlled URI may be resolved and sent to the attacker.


21) Improper Authentication (CVE-ID: CVE-2026-53913)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication in KeycloakSecurityPolicy when handling requests with a bearer token in the Authorization header under the default configuration with no required roles or permissions. A remote attacker can send a request with any non-null bearer value to bypass authentication.

The issue occurs because token cryptographic verification is performed only during role or permission checks, which are skipped in the default configuration.


22) Information Exposure Through an Error Message (CVE-ID: CVE-2026-49365)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive internal information.

The vulnerability exists due to generation of error messages containing sensitive information in the camel-netty-http HTTP server consumer when handling requests that trigger route processing errors. A remote attacker can send a malformed request or invalid parameter to disclose sensitive internal information.

The HTTP response body may include the full Java stack trace, including exception message contents, host and path details, dependency information, and application structure.


23) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-49099)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject SOQL or SOSL queries, override the target sObject, and redirect Apex REST calls.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component and authorization bypass through user-controlled key in the camel-salesforce producer when processing inbound HTTP headers bridged into Exchange headers. A remote attacker can send a specially crafted HTTP request with non-Camel-prefixed Salesforce control headers to inject SOQL or SOSL queries, override the target sObject, and redirect Apex REST calls.

Exploitation is possible in routes that bridge an HTTP consumer into a salesforce: producer, and all resulting operations run with the permissions of the connected Salesforce user.


24) Input validation error (CVE-ID: CVE-2026-49098)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect Kafka messages to an arbitrary topic.

The vulnerability exists due to improper input validation in the Camel Kafka component header handling when processing HTTP headers in a route that bridges an HTTP consumer to a kafka producer. A remote attacker can send a specially crafted HTTP request with a kafka.OVERRIDE_TOPIC header to redirect Kafka messages to an arbitrary topic.

The issue occurs because non-Camel-prefixed kafka.* exchange header names can pass through the upstream HTTP header filter unmodified.


25) Input validation error (CVE-ID: CVE-2026-49097)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect outgoing IRC messages to arbitrary channels or users.

The vulnerability exists due to improper input validation in the Camel IRC component control header handling when processing inbound HTTP requests bridged to an irc: producer. A remote attacker can send a specially crafted HTTP request with irc.* headers to redirect outgoing IRC messages to arbitrary channels or users.

The issue occurs because non-Camel-prefixed IRC control headers can pass through the HTTP header filter and override the configured IRC destination.


26) Input validation error (CVE-ID: CVE-2026-49086)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect the re-published message to an arbitrary Dapr Pub/Sub component and topic.

The vulnerability exists due to improper input validation in DaprPubSubConsumer and DaprConfigurationOptionsProxy when processing inbound CloudEvents and republishing messages through a Dapr producer. A remote attacker can publish a specially crafted message to the subscribed topic to redirect the re-published message to an arbitrary Dapr Pub/Sub component and topic.

The issue can bypass the route's intended routing and topic-level access controls in the underlying broker.


27) Information Exposure Through an Error Message (CVE-ID: CVE-2026-56139)

CWE-ID: CWE-209 - Information Exposure Through an Error Message

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to generation of error messages containing sensitive information in the Camel Undertow HTTP server consumer when handling requests that trigger route processing errors. A remote attacker can send a malformed request or invalid parameter to disclose sensitive information.

For Rest DSL consumers, the muteException option was not honored, causing stack traces to be returned even when that option had been enabled.


28) Input validation error (CVE-ID: CVE-2026-48205)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect DNS queries to an attacker-controlled server and disclose sensitive information about internal hostnames.

The vulnerability exists due to improper input validation in the Camel-DNS producer header handling when processing HTTP requests bridged into a dns: producer. A remote attacker can send a specially crafted request with dns.* or term headers to redirect DNS queries to an attacker-controlled server and disclose sensitive information about internal hostnames.

In affected routes, the HTTP header filter does not block these non-Camel-prefixed header names at the HTTP boundary.


29) Improper access control (CVE-ID: CVE-2026-48204)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform unauthorized GridFS operations, including deleting files, reading files, and enumerating stored files.

The vulnerability exists due to improper access control in the Camel MongoDB GridFS producer when handling inbound HTTP requests bridged to a mongodb-gridfs endpoint with no explicit operation configured. A remote attacker can send crafted gridfs.* headers to override the intended GridFS operation and perform unauthorized GridFS operations, including deleting files, reading files, and enumerating stored files.

Exploitation also allows attacker-supplied gridfs.metadata values to be parsed as a MongoDB document, enabling NoSQL operator injection. No credentials are required when the bridging HTTP consumer is unauthenticated.


30) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-48203)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the camel-solr producer when bridging an inbound HTTP request to a solr: producer. A remote attacker can send crafted SolrParam.* headers to perform server-side request forgery.

In affected routes, injected parameters can include shards or stream.url to make the Solr server issue requests to attacker-chosen URLs, or qt to reach administrative request handlers.


31) Input validation error (CVE-ID: CVE-2026-46726)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery and disclose sensitive information.

The vulnerability exists due to improper input validation in VertxWebsocketConsumer.populateExchangeHeaders() when mapping inbound WebSocket query and path parameters into the Camel Exchange header map. A remote attacker can supply crafted WebSocket query parameters to inject Camel control headers and perform server-side request forgery and disclose sensitive information.

Exploitation requires a route in which the WebSocket consumer feeds a downstream HTTP producer, and property placeholders embedded in the attacker-controlled URI are resolved to real values.


32) Input validation error (CVE-ID: CVE-2026-46592)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect the invoked SOAP operation.

The vulnerability exists due to improper input validation in the Camel CXF SOAP producer when bridging an inbound HTTP request into a cxf: producer. A remote attacker can send a crafted HTTP request with operation-selection headers to redirect the invoked SOAP operation.

No credentials are required when the bridging HTTP consumer is unauthenticated.


33) SQL injection (CVE-ID: CVE-2026-46591)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read, modify, or delete data in the Neo4j database.

The vulnerability exists due to improper neutralization of special elements in data query logic in the camel-neo4j producer when building the Cypher WHERE clause from the CamelNeo4jMatchProperties header. A remote user can supply crafted JSON property names that are interpolated into the query string to read, modify, or delete data in the Neo4j database.

The issue is reachable when a route maps untrusted input into the CamelNeo4jMatchProperties map or carries untrusted data into that header.


34) Deserialization of Untrusted Data (CVE-ID: CVE-2026-46590)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to deserialization of untrusted data in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path in FileBasedKeyLifecycleManager when deserializing persisted key metadata from the configured secret backend. A remote user can store a crafted serialized object in the backend to execute arbitrary code.

Exploitation requires write access to the operator-controlled backend that stores the persisted values, such as the HashiCorp Vault KV path or the AWS Secrets Manager secret.


Remediation

Install update from vendor's website.

References