PT-2026-41898 · Apache · Camel-Cxf+1

Quac Tran · CVE-2026-47323 · Published 2026-05-10 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Camel (affected versions not specified)

Description An unauthenticated attacker can perform message header injection due to missing inbound filtering in the CxfRsHeaderFilterStrategy and Knative HeaderFilterStrategy implementations. This allows the injection of Camel-internal headers to override configured values, which can lead to remote code execution or arbitrary file writes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-178

CWE-791

Related Identifiers

BDU:2026-10102

CVE-2026-47323

GHSA-8364-HFQJ-PWM6

Affected Products

Camel-Cxf

Camel-Knative

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47323.json · Exploit
• 🔥 https://github.com/oscerd/CVE-2026-47323 · Exploit
• https://osv.dev/vulnerability/CVE-2026-47323 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8364-hfqj-pwm6 · Vendor Advisory
• https://camel.apache.org/security/CVE-2026-47323.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47323 · Security Note
• https://bdu.fstec.ru/vul/2026-10102 · Security Note
• https://github.com/apache/camel · Note
• https://t.me/cveNotify/165973 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-47323 · Note
• https://twitter.com/ptdbugs/status/2078115618931216880 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056871559961117059 · Twitter Post
• https://twitter.com/CVEnew/status/2056870275581399475 · Twitter Post
• https://twitter.com/oss_security/status/2056967672772939799 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47323.json · Note