CVE-2026-55994 camel vulnerability
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange). Because nothing blocked the Camel header namespace, an actor able to publish to the consumed Iggy stream/topic could set Camel-internal control headers - including CamelHttpUri (Exchange.HTTP_URI) - simply by supplying them as message user-headers. In a route where the Iggy consumer feeds a downstream HTTP producer, the injected CamelHttpUri redirects the server-side HTTP request to an attacker-chosen destination (server-side request forgery - for example to an internal service or a cloud metadata endpoint). In addition, the HTTP producer resolves Camel property placeholders on the resulting (attacker-controlled) URI, so placeholders embedded in the injected value - such as an environment-variable reference, an application property, or a vault reference - are resolved to their real values and sent to the attacker, disclosing environment variables, application properties and vault secrets. This issue affects Apache Camel: from 4.17.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix adds a dedicated IggyHeaderFilterStrategy (and a headerFilterStrategy endpoint option) that filters the Camel header namespace case-insensitively on inbound mapping, so externally-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that cannot upgrade immediately, strip the Camel control headers from the inbound message before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), restrict who can publish to the consumed Iggy stream/topic, and avoid bridging an untrusted consumer directly into an HTTP producer whose target URI can be driven from message headers.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
Apache Camel is affected by CVE-2026-55994, a SSRF and internal request risk. Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The recommended remediation is to update to Apache Camel 4.18.3, 4.21.0, or a later fixed release for the deployed Iggy component branch. Until the update is complete, filter inbound Iggy user headers and block Camel-internal control headers until patched, review logs, and reduce exposure of the affected package, route, provider, or service workflow.
- Inventory every deployment, package, dependency, build runner, integration, route, service, and managed environment that uses Apache Camel.
- Confirm the installed version/build and compare it with versions from 4.19.0 before 4.21.0. Users are recommended through upgrade and the source advisory for CVE-2026-55994.
- Apply the vendor-supported fix: update to Apache Camel 4.18.3, 4.21.0, or a later fixed release for the deployed Iggy component branch.
- If the update cannot be applied immediately, filter inbound Iggy user headers and block Camel-internal control headers until patched; disable unnecessary public access, package-install paths, file processing, webhooks, message consumers, or high-risk integrations until patched.
- Review application, CI/CD, package manager, container, reverse-proxy, WAF, authentication, route, and audit logs for activity related to CVE-2026-55994.
- Rotate sessions, API tokens, package registry credentials, cloud credentials, webhook secrets, service credentials, and administrator passwords if logs or affected data indicate compromise, credential exposure, or unauthorized access.
- Clear caches, restart affected services, rebuild affected containers or build agents when appropriate, and remove temporary files, malicious artifacts, stored payloads, or unsafe configuration created during exploitation attempts.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm Apache Camel now reports Apache Camel 4.18.3, 4.21.0, or a later fixed release for the deployed Iggy component branch or a later vendor-supported fixed release/build for the deployed branch.
- Verify the affected workflow no longer allows the behavior described in CVE-2026-55994, using a safe regression test, dependency inventory, or vendor validation method.
- Review logs after remediation for continued exploit attempts, denial-of-service symptoms, suspicious redirects, unauthorized requests, path traversal, header manipulation, credential exposure, or configuration changes.
- Rerun a Fixnx scan and any product-specific scanner, package audit, dependency check, route regression test, or integration test relevant to the affected service.
- Document affected assets, fixed versions, mitigation decisions, validation evidence, and any cleanup, rebuild, or credential rotation performed.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-55994?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.