Authorization bypass through user-controlled key in Apache Camel - CVE-2026-46453
Published: August 24, 2026
Vulnerability identifier: #VU144709
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46453
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to override the Elasticsearch query and operation.
The vulnerability exists due to improper input validation in the camel-elasticsearch-rest-client component when handling inbound HTTP headers. A remote attacker can send a specially crafted request with unprefixed header names to override the Elasticsearch query and operation.
The issue occurs when a Camel route exposes an HTTP entry point in front of an elasticsearch-rest-client producer, and no credentials are required.
Affected software
Apache Camel
How to mitigate CVE-2026-46453
Install security update from vendor's website.
Apache Camel - addressed in versions 4.15.0, 4.19.0, 4.21.0