Improper access control in Apache Camel - CVE-2026-48204

Vulnerability details

The vulnerability allows a remote attacker to perform unauthorized GridFS operations, including deleting files, reading files, and enumerating stored files.

The vulnerability exists due to improper access control in the Camel MongoDB GridFS producer when handling inbound HTTP requests bridged to a mongodb-gridfs endpoint with no explicit operation configured. A remote attacker can send crafted gridfs.* headers to override the intended GridFS operation and perform unauthorized GridFS operations, including deleting files, reading files, and enumerating stored files.

Exploitation also allows attacker-supplied gridfs.metadata values to be parsed as a MongoDB document, enabling NoSQL operator injection. No credentials are required when the bridging HTTP consumer is unauthenticated.

Affected software

How to mitigate CVE-2026-48204

External References

• https://lists.apache.org/api/email.lua?id=cnnhkx9r5s0lyljb7c16ndqyw0rk9824
• https://camel.apache.org/security/CVE-2026-48204.html

Related Security Bulletins

• Multiple vulnerabilities in Apache Camel