What is the CVSS score of CVE-2026-48204?

CVE-2026-48204 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-48204?

Apache Camel's file management component contains a critical vulnerability that allows remote attackers without credentials to intercept and override file operations, potentially enabling data…. A patch is available.

How to fix or mitigate CVE-2026-48204?

Within 24 hours: Inventory all production systems running vulnerable Apache Camel versions (4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0-4.20.x) and identify those with mongodb-gridfs features exposed through HTTP endpoints. Within 7 days: Apply the patched Apache Camel version per the vendor advisory for CVE-2026-48204. Within 30 days: Verify all file management routes have explicit, hardcoded operations defined rather than accepting dynamic operation selection through network requests.

Apache Camel CVE-2026-48204

EUVD-2026-41839 CRITICAL

Improper Input Validation (CWE-20)

2026-07-05

GHSA-f7g3-2cg6-f5hj

Apache Microsoft File Upload Camel

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Given the default header-driven route bridged from unauthenticated HTTP, exploitation is network-based with no auth or interaction (AV:N/AC:L/PR:N/UI:N) and yields full read/delete/enumerate impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:19 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:46 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 maven packages depend on org.apache.camel:camel-mongodb-gridfs (3 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Unauthenticated NoSQL operation hijacking in Apache Camel's camel-mongodb-gridfs component (4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0-4.20.x) lets a remote HTTP client override the intended GridFS operation and inject MongoDB query documents. When a route bridges an HTTP consumer such as platform-http into a mongodb-gridfs: producer that has no explicit operation set (the default), the raw gridfs.operation, gridfs.objectid and gridfs.metadata headers pass through the HTTP header filter because they lack the Camel/camel prefix, allowing an attacker to turn an intended upload into remove, listAll, or findOne and to inject NoSQL operators. There is no public exploit identified at time of analysis and EPSS is low (0.16%), but CVSS is 9.8 and SSVC rates technical impact as total and automatable.

Technical ContextAI

Apache Camel is a widely used Java enterprise-integration framework whose routes move messages between components via an Exchange carrying headers. The camel-mongodb-gridfs producer talks to MongoDB GridFS, a specification for storing large binary files as chunked documents in a MongoDB bucket. The producer chooses its action from the gridfs.operation Exchange header whenever the endpoint's operation parameter is unset. The root cause (CWE-20, Improper Input Validation, combined with improper access control) is that the control-header constants were defined as the bare strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. HttpHeaderFilterStrategy only strips headers in the Camel/camel namespace at the HTTP boundary, so these un-prefixed control headers were never filtered out and flowed from an inbound HTTP request directly into the Exchange, letting untrusted input drive privileged data-layer operations and be parsed as a MongoDB document.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.21.0, which fixes the issue; on the 4.14.x LTS stream upgrade to 4.14.8, and on the 4.18.x stream upgrade to 4.18.3, per https://camel.apache.org/security/CVE-2026-48204.html. After upgrading, any route that drives GridFS operations or metadata through the raw header names must be updated to use the new prefixed constants CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize and CamelGridFsFileId instead of the gridfs.* names, or those operations will stop working. For deployments that cannot upgrade immediately, set an explicit operation parameter on the mongodb-gridfs: endpoint so the operation is never taken from a header, and strip all gridfs.* headers from untrusted ingress before the producer (for example with a removeHeaders step on the inbound HTTP route); the trade-off is that legitimate clients relying on header-driven operation selection must be reworked, and the header-stripping filter must be kept in sync with the full set of gridfs.* control headers.