CVE-2026-46454 camel vulnerability
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified. Because a CometdComponent installs no Bayeux SecurityPolicy by default, any client that can complete the Bayeux handshake against the CometD endpoint can publish such a message without authentication. An attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a JMS destination); the injected headers also persist across internal direct, seda and vm hops. The concrete downstream impact depends on which producers the route uses. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that cannot upgrade immediately, strip the Camel control headers from inbound CometD messages before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), and install an explicit Bayeux SecurityPolicy on the CometdComponent so that only authenticated clients can publish.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-46454 affects Apache Camel Cometd. Upgrade Apache Camel on the deployed branch to a fixed release (4.14.8, 4.18.3, 4.21.0) and review routes that expose this component to external or user-controlled messages. Affected ranges in the local NVD record are 4.0.0 through before 4.14.8; 4.15.0 through before 4.18.3; 4.19.0 through before 4.21.0.
- Inventory every service, integration route, container image, and build manifest that includes Apache Camel Cometd or transitive Camel modules related to Cometd.
- Compare each deployed Camel version with the affected ranges for CVE-2026-46454; treat 4.0.x-4.14.7, 4.15.x-4.18.2, and 4.19.x-4.20.x as needing an upgrade when the component is present.
- Upgrade to the fixed Camel release for the active branch: 4.14.8, 4.18.3, 4.21.0, or a later vendor-supported release.
- Rebuild application artifacts and container images from a clean dependency lockfile so no vulnerable Camel module remains through transitive dependencies.
- Harden exposed routes by filtering user-controlled Camel headers and component-specific control headers before data reaches Camel producers or internal route logic.
- Rotate credentials or integration tokens if logs, routing headers, backend endpoints, or message contents may have been exposed or redirected through the vulnerable route.
- Deploy first to staging, run regression tests for the impacted route, then promote to production with monitoring for routing errors, authorization failures, SSRF attempts, and unexpected message destinations.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm dependency output shows Apache Camel 4.14.8, 4.18.3, 4.21.0 or a later fixed release in every affected application.
- Run route-level tests that replay malicious or unexpected headers and verify they are removed, ignored, or rejected before reaching Camel internals.
- Check application logs after deployment for exceptions, leaked stack traces, SSRF indicators, unauthorized backend operations, or unexpected route destinations.
- Open the generated Fixnx page and confirm the canonical URL ends with camel-cve-2026-46454.
- Re-run sitemap validation and confirm camel-cve-2026-46454 appears once in sitemap.xml with the full CVE-2026-46454 suffix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-46454?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.