CVE-2026-49099

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.52% · Oct 25, 2026

A flaw was found in Apache Camel Salesforce. Due to improper neutralization of special elements, non-Camel-prefixed HTTP headers are not filtered, allowing them to pass from an inbound HTTP request. A remote, unauthenticated attacker can exploit this by injecting malicious headers to override intended operations. This enables unauthorized access to Salesforce data through custom SOQL/SOSL queries, modification of SObject operations, or redirection of Apex REST calls with the full permissions of the connected Salesforce user. camel-salesforce: Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour This Moderate vulnerability in Apache Camel Salesforce component allows an unauthenticated HTTP client to bypass header filtering in routes that bridge an HTTP consumer to a Salesforce producer. An attacker can inject arbitrary Salesforce operation parameters, potentially leading to unauthorized data access, modification, or redirection of Apex REST calls with the full permissions of the connected Salesforce user. This risk is present when the affected component is deployed in a vulnerable bridging configuration. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.