CVE-2026-46592

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the `operationName` header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the `CxfProducer` to invoke unintended SOAP operations on the backend service. This could lead to a 'confused deputy' scenario, where a read operation is replaced with a destructive one, impacting the integrity of the backend service. org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation This is an Important flaw in the Apache Camel CXF SOAP component, allowing a remote, unauthenticated attacker to manipulate SOAP operation names via HTTP headers. When an HTTP consumer bridges into a `cxf:` producer, an attacker can force the backend service to execute unintended operations, potentially replacing read operations with destructive ones. This 'confused deputy' scenario impacts the integrity of services utilizing affected Red Hat build of Apache Camel and Enterprise Application Platform configurations. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.