CVE-2026-46584

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.56% · Oct 25, 2026

A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of SMTP connections to an attacker-controlled server, exposing user credentials. In later versions, the impact is limited to weakening transport security and intercepting outgoing messages, potentially leading to information disclosure. org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers This Moderate impact flaw in the Apache Camel Mail Component arises from improper input validation, allowing remote attackers to exploit routes that channel untrusted input into the mail producer without explicit header stripping. Depending on the Apache Camel version, this could lead to credential exposure by redirecting SMTP connections to an attacker-controlled server or, in newer versions, to the weakening of transport security and interception of outgoing messages. Exploitation is contingent on the application's routing configuration. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.