High severity · published Jul 6, 2026
CVE-2026-46588
Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
7.3
CVSS
0.7%
EPSS
No
On KEV
Description
Improper Input Validation vulnerability in Apache Camel.
This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.
Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache Camel · Apache Software Foundation
through 4.14.7; 4.15.0 through 4.18.2; 4.19.0 through 4.20.0 · source: vendor
CA
Camel · Apache
4.0.0 before 4.14.8; 4.15.0 before 4.18.3; 4.19.0 before 4.21.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46588
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46588
Vendor Advisory
https://camel.apache.org/security/CVE-2026-46588.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/07/06/16
More from Apache Camel
10.0
CVE-2026-78162
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
10.0
CVE-2026-33453
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
9.8
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
9.8
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
9.8
CVE-2026-43867
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter