What is the CVSS score of CVE-2026-46726?

CVE-2026-46726 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-46726?

Apache Camel's camel-vertx-websocket component (versions 4.0.0-4.20.x) contains a server-side request forgery and secret disclosure vulnerability allowing unauthenticated attackers to steal…. A patch is available.

How to fix or mitigate CVE-2026-46726?

24 hours: Inventory all systems using Apache Camel versions 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x; isolate affected systems from untrusted networks if possible. 7 days: Test patched versions in non-production environments and establish deployment schedule. 30 days: Deploy patches to all affected production systems.

Apache Camel CVE-2026-46726

EUVD-2026-41837 HIGH

Improper Input Validation (CWE-20)

2026-07-05

GHSA-hgg5-gp4c-gpcg

Apache SSRF Microsoft Red Hat Hashicorp Camel

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network reach against an exposed WebSocket endpoint (AV:N/PR:N/UI:N), low-complexity header injection (AC:L), high confidentiality from secret/SSRF disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:34 vuln.today

v4 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:50 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-vertx-websocket (3 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 5

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026 News Critical SSRF & Secret Disclosure in HashiCorp via Apache Camel - CVE-2026-46726 Jul 05, 2026

AnalysisAI

Server-side request forgery and secret disclosure in Apache Camel's camel-vertx-websocket component (versions 4.0.0-4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.x) let a WebSocket client inject Camel-internal control headers such as CamelHttpUri because inbound query/path parameters are copied into the Exchange header map without a HeaderFilterStrategy. In routes that bridge the WebSocket consumer into a downstream HTTP producer, an attacker can redirect the server-side HTTP request to internal services or cloud metadata endpoints, and because the HTTP producer resolves Camel property placeholders on the attacker-supplied URI, environment variables, application properties, and vault secrets are resolved and exfiltrated. When the WebSocket endpoint is exposed without authentication (PR:N per CVSS), this is reachable by an unauthenticated remote attacker; there is no public exploit identified at time of analysis, and EPSS is low at 0.24%.

Technical ContextAI

Apache Camel is a widely used Java integration framework built around routes that move messages (Exchanges) between components. The flaw is in the camel-vertx-websocket consumer, specifically VertxWebsocketConsumer.populateExchangeHeaders(), which mapped inbound WebSocket query and path parameters directly into the Exchange header map with no HeaderFilterStrategy applied. Camel uses reserved 'Camel*' header names as internal control signals - notably CamelHttpUri (Exchange.HTTP_URI), which the HTTP producer uses to determine its target endpoint. Because the Camel header namespace was not filtered, externally supplied parameters could overwrite these control headers. The root cause maps to CWE-20 (Improper Input Validation): trusting external input to populate a privileged internal namespace. A compounding behavior is that the HTTP producer runs Camel property-placeholder resolution over the resulting URI, turning an SSRF primitive into a secrets-disclosure primitive when placeholders like environment-variable, property, or vault references are embedded in the injected value.

RemediationAI

Vendor-released patch: upgrade to 4.21.0, which applies a HeaderFilterStrategy that case-insensitively filters the Camel header namespace on inbound mapping so externally supplied Camel*/camel* headers are no longer copied into the Exchange. Stream-specific fixed versions are 4.14.8 for the 4.14.x LTS line and 4.18.3 for the 4.18.x line, per the vendor advisory at https://camel.apache.org/security/CVE-2026-46726.html. For deployments that cannot upgrade immediately, strip Camel control headers at the start of the route before they reach any producer using both removeHeaders('Camel*') and removeHeaders('camel*') to cover the case-insensitive bypass; require authentication on the WebSocket endpoint; and avoid bridging an untrusted vertx-websocket consumer directly into an HTTP producer whose target URI can be influenced by message headers. The header-stripping mitigation has minimal side effects but must include both case variants, and requiring authentication may break existing unauthenticated clients that legitimately connect to the endpoint.