PT-2026-55909 · Apache · Apache Camel
Andrea Cosentino
+1
·
Published
2026-07-06
·
Updated
2026-07-06
·
CVE-2026-55993
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache Camel versions 4.0.0 through 4.14.7
Apache Camel versions 4.15.0 through 4.18.2
Apache Camel versions 4.19.0 through 4.20.9
Description
Improper input validation in the Atmosphere WebSocket component allows an unauthenticated remote attacker to perform Server-Side Request Forgery (SSRF) and expose sensitive information. The
camel-atmosphere-websocket consumer maps inbound WebSocket query parameters to the Camel Exchange header map without applying a HeaderFilterStrategy in the WebsocketConsumer.sendEventNotification() function. This allows an attacker to set internal control headers, such as CamelHttpUri (represented by the Exchange.HTTP URI variable), via query parameters. If the WebSocket consumer feeds into a downstream HTTP producer, the injected CamelHttpUri redirects the server-side request to an attacker-controlled destination. Furthermore, the HTTP producer resolves Camel property placeholders within the URI, potentially disclosing environment variables, application properties, and vault secrets to the attacker.Recommendations
Update Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8.
Update Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3.
Update Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0.
As a temporary mitigation, remove Camel control headers from inbound messages using
removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route.
Require authentication on the WebSocket endpoint.
Avoid bridging untrusted consumers directly to an HTTP producer where the target URI is determined by message headers.Information Disclosure
RCE
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Camel