CVE-2026-46454: camel from 4.0.0 (inclusive), before 4.14.8 (exclusive), from 4.15.0 (inclusive), before 4.18.3 (exclusive), from…

Affected technology

camel · from 4.0.0 (inclusive), before 4.14.8 (exclusive)
apache

camel · from 4.15.0 (inclusive), before 4.18.3 (exclusive)
apache

camel · from 4.19.0 (inclusive), before 4.21.0 (exclusive)
apache

Apache Camel · 4.0.0 to before 4.14.8, 4.15.0 to before 4.18.3, 4.19.0 to before 4.21.0
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a JMS destination); the injected headers also persist across internal direct, seda and vm hops. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.