Skip to content
OpenAdvisories
Medium WID-SEC-2026-2983 8 CVEs

Apache Camel: Mehrere Schwachstellen

Published Aug 24, 2026 · Updated Nov 10, 2026 · Revision 3 · de

Vendor: Apache Vendor: Red Hat Product: Camel Product: Enterprise Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren oder sensible Informationen offenzulegen.

Product

Apache Camel ist ein Integrations-Framework, das Enterprise Integration Patterns implementiert.

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-71300 Public exploit

    Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

    Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which conn…

    Apache Software Foundation Apache Camel org.apache.camel:camel-atmosphere-websocket Maven
  • Critical 9.8
    CVE-2026-78329 Public exploit

    Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

    Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base…

    Apache Software Foundation Apache Camel org.apache.camel:camel-undertow Maven
  • Critical 9.1
    CVE-2026-66906 Public exploit

    Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

    Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure S…

    Apache Software Foundation Apache Camel org.apache.camel:camel-azure-storage-blob Maven
  • High 7.5
    CVE-2026-66907 Public exploit

    Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

    Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage o…

    Apache Software Foundation Apache Camel org.apache.camel:camel-google-storage Maven
  • High 7.5
    CVE-2026-66908 Public exploit

    Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

    Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authentica…

    Apache Software Foundation Apache Camel org.apache.camel:camel-platform-http-main Maven
  • Medium 6.5
    CVE-2026-59230 Public exploit

    Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

    Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME mul…

    Apache Software Foundation Apache Camel org.apache.camel:camel-mail Maven
  • Medium 5.5
    CVE-2026-60093 Public exploit

    Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

    Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an …

    Apache Software Foundation Apache Camel org.apache.camel:camel-azure-storage-datalake Maven
  • Medium 5.3
    CVE-2026-63621 Public exploit

    Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

    Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel m…

    Apache Software Foundation Apache Camel org.apache.camel:camel-knative Maven

Revision history

  1. #3

    Neue Updates von Red Hat aufgenommen

  2. #2

    Neue Updates von Red Hat aufgenommen

  3. #1

    Initiale Fassung

References