CVE-2026-46457

[CVE catalog]

A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route, potentially leading to actions such as redirecting HTTP producers, altering file names, or overriding queries. This vulnerability allows for manipulation of the application's control flow. camel-nats: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers This Important vulnerability in the Apache Camel NATS component allows an unauthenticated attacker to inject arbitrary Camel control headers into the message exchange. This is possible when the NATS server lacks authentication, enabling a client to manipulate downstream producer behavior, such as redirecting HTTP requests or altering file operations. The impact is significant due to the potential for unauthorized control over data flow within Camel routes. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.66% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": "4.14.8"
    },
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": "4.18.3"
    },
    {
      "name": "camel",
      "ecosystem": "cpe",
      "fixed_version": "4.21.0"
    },
    {
      "name": "org.apache.camel:camel-nats",
      "ecosystem": "maven",
      "fixed_version": "4.21.0",
      "provider_record_id": "GHSA-7V55-Q9X3-83CJ"
    },
    {
      "name": "camel",
      "ranges": [
        {
          "fixed": "4.21.0",
          "introduced": "4.19.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "4.21.0",
      "provider_record_id": "NVD-CVE-2026-46457"
    }
  ]
}