Input validation error in Apache Camel - CVE-2026-46726
Published: August 24, 2026
Vulnerability identifier: #VU144698
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46726
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform server-side request forgery and disclose sensitive information.
The vulnerability exists due to improper input validation in VertxWebsocketConsumer.populateExchangeHeaders() when mapping inbound WebSocket query and path parameters into the Camel Exchange header map. A remote attacker can supply crafted WebSocket query parameters to inject Camel control headers and perform server-side request forgery and disclose sensitive information.
Exploitation requires a route in which the WebSocket consumer feeds a downstream HTTP producer, and property placeholders embedded in the attacker-controlled URI are resolved to real values.
Affected software
Apache Camel
How to mitigate CVE-2026-46726
Install security update from vendor's website.
Apache Camel - addressed in versions 4.15.0, 4.19.0, 4.21.0