CVE-2026-49098

[Catalogue CVE]

A flaw was found in the Apache Camel Kafka Component. A remote attacker can exploit an improper input validation vulnerability by manipulating specific Kafka headers, such as `kafka.OVERRIDE_TOPIC`, when an HTTP consumer bridges into a Kafka producer. This allows the attacker to redirect messages to arbitrary Kafka topics, potentially injecting malicious content into sensitive internal topics or services. Additionally, attackers can manipulate `kafka.OVERRIDE_TIMESTAMP` and `kafka.PARTITION_KEY` headers to backdate messages or target specific partitions, leading to data integrity issues or denial of service. No authentication is required if the bridging consumer is unauthenticated. camel-kafka: Apache Camel Kafka Component: Message redirection and injection via header manipulation A flaw was found in the Apache Camel Kafka component. The Kafka Exchange header constants use non-Camel-prefixed names (kafka.* format) that bypass the HTTP header filter, allowing an unauthenticated HTTP client to redirect messages to arbitrary Kafka topics, backdate timestamps, or target specific partitions. Red Hat builds of Apache Camel for Spring Boot and Quarkus ship the affected camel-kafka component. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravité

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.61% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "camel",
      "fixed_version": "4.14.8",
      "applicability_unknown": true
    },
    {
      "name": "camel",
      "fixed_version": "4.18.3",
      "applicability_unknown": true
    },
    {
      "name": "camel",
      "fixed_version": "4.21.0",
      "applicability_unknown": true
    },
    {
      "name": "org.apache.camel:camel-kafka",
      "ecosystem": "maven",
      "provider_url": "https://github.com/advisories/GHSA-mm84-qvjh-hcj7",
      "fixed_version": "4.21.0",
      "provider_source": "github",
      "provider_record_id": "GHSA-MM84-QVJH-HCJ7",
      "provider_updated_at": "2026-08-28T20:14:53Z"
    }
  ]
}