CVE-2026-78164
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
02 Description
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 0.34% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 27.6% of scored records. A rank, not a probability.
- NVD base score
- 8.2 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-19.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-19 10:07Z10 DAYS AGO
- Last updated
- 2026-10-19 18:46Z9 DAYS AGO
- Reserved
- 2026-08-23
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- High (CVSS 8.2)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weaknesses
- Data version
- 5.2
- Document digest
- 6c9c86ea04e53edd871b1cb493400317d88f3d39c10b8215e024ca61fb4d7d87
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-78164https://camel.apache.org/security/CVE-2026-78164.html
- issues.apache.orgCAMEL-24418https://issues.apache.org/jira/browse/CAMEL-24418
- github.comFix on mainhttps://github.com/apache/camel/pull/25571
- github.comFix commit on main (4.23.0)https://github.com/apache/camel/commit/ba5aced7f6a1c38a963020575676ad4c76b492cf
- github.comBackport commit on camel-4.22.x (4.22.1)https://github.com/apache/camel/commit/9f8a185e315ce9e120889c4106be3dbf4688e507
- github.comBackport commit on camel-4.18.x (4.18.5)https://github.com/apache/camel/commit/7cec534c66969015d85e56631143174dd150ed94
07 Remediation
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, strip the override headers at the trust boundary before the producer with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri"), or set skipControlHeaders=true on camel-http endpoints, which is the only component offering that option. Note that bridgeEndpoint=true is not a workaround: it suppresses the header override when the outbound URL is built but not when the header is re-parsed for the query string. Percent-encoding the placeholder delimiters is likewise not a mitigation for camel-netty-http, whose binding decodes the request path before the value reaches the header, so proxy or WAF rules written against the raw delimiters do not help there. As defence in depth, ensure consumers exposed to untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel namespace, and resolve secrets through a vault rather than through environment variables or system properties that a placeholder can name.