What is the CVSS score of CVE-2026-46592?

CVE-2026-46592 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-46592?

Camel-based infrastructure bridging HTTP services to backend SOAP systems exposes an operation-injection vulnerability in camel-cxf (versions 4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0-4.20.x) that could…. A patch is available.

How to fix or mitigate CVE-2026-46592?

Within 24 hours: Inventory all Apache Camel deployments and identify those using camel-cxf with versions 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x; confirm patch availability from your artifact repository. Within 7 days: Stage and test Camel versions 4.14.8, 4.18.3, and 4.21.0 in non-production environments, validating all SOAP route functionality remains intact. Within 30 days: Deploy patched versions to production using a phased rollout; implement integration tests confirming that HTTP header injection does not alter backend operation routing.

Apache Camel CVE-2026-46592

EUVD-2026-41836 HIGH

Improper Input Validation (CWE-20)

2026-07-06 apache

GHSA-mrrp-9gjm-749v

Apache Information Disclosure Microsoft Red Hat Apache Camel Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

8.2 HIGH

Confused-deputy redirection to unintended/destructive backend operations is primarily integrity (I:H) with limited confidentiality; PR:N holds only when the bridging HTTP consumer is unauthenticated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:26 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 06, 2026 - 09:42 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 maven packages depend on org.apache.camel:camel-cxf-rest (5 direct, 5 indirect)
31 maven packages depend on org.apache.camel:camel-cxf-soap (6 direct, 25 indirect)

Ecosystem-wide dependent count for version 4.0.0 and other introduced versions.

DescriptionCVE.org

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component.

The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and have CxfProducer resolve and invoke a different WSDL operation than the route intended - for example replacing a read operation with a destructive one - against the backend SOAP service (a confused-deputy redirection). The constant is defined in the shared camel-cxf-common module, so the same non-prefixed names also applied to camel-cxfrs. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.

Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern. For deployments that cannot upgrade immediately, do not select the CXF operation from untrusted input: strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer and set the operation from a trusted source in the route.

AnalysisAI

Confused-deputy operation redirection in the Apache Camel camel-cxf SOAP component (versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0) lets an attacker steer which backend SOAP operation gets invoked. Because the operationName / operationNamespace selection headers lacked the Camel/camel prefix, HttpHeaderFilterStrategy failed to strip them at the HTTP boundary, so in any route bridging an HTTP consumer (e.g. platform-http) into a cxf: producer, an HTTP client could inject these headers and force CxfProducer to call a different WSDL operation than intended - for example swapping a read for a destructive write. No public exploit is identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV.

Technical ContextAI

Apache Camel is a Java enterprise integration framework; the camel-cxf component wraps Apache CXF to consume and produce SOAP/JAX-WS web services. The camel-cxf producer selects its target SOAP operation from the Exchange headers CxfConstants.OPERATION_NAME and OPERATION_NAMESPACE, whose literal values were the unprefixed strings 'operationName' and 'operationNamespace'. Camel's HttpHeaderFilterStrategy only blocks headers in the Camel/camel namespace when crossing the HTTP transport boundary, so these unprefixed control headers were treated as ordinary application data and passed from inbound HTTP straight into the Exchange. This is a CWE-20 improper input validation issue manifesting as a Confused Deputy: trusted routing logic acts on attacker-controlled input it should never have accepted. Because the constant lives in the shared camel-cxf-common module, the same flaw also applied to camel-cxfrs. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_camel.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.21.0, which fixes the issue; users on the 4.14.x LTS stream should move to 4.14.8, and users on the 4.18.x stream to 4.18.3. After upgrading, the operation-selection headers are renamed CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries, so review the 4.21 upgrade guide for the cross-transport carrier-header pattern if your routes deliberately propagate operation selection. If you cannot upgrade immediately, do not derive the CXF operation from untrusted input: explicitly strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer (for example with a removeHeaders step) and set the operation from a trusted source in the route; the side effect is that legitimate clients can no longer choose the operation dynamically over HTTP, so any intended dynamic-dispatch behavior must be re-implemented from trusted routing logic. Authenticating the bridging HTTP consumer also removes the unauthenticated-attacker path. See https://camel.apache.org/security/CVE-2026-46592.html.