Apache Camel JIRA CVE-2026-48206

Apache Camel's HttpHeaderFilterStrategy enforces a security boundary at HTTP consumer endpoints by stripping headers whose names begin with the 'Camel' or 'camel' prefix, preventing external callers from injecting Camel-internal control values into the Exchange. The camel-jira component defines its operation parameters as JiraConstants fields whose string values were plain, unprefixed names - ISSUE_KEY = 'IssueKey', ISSUE_PROJECT_KEY = 'ProjectKey', ISSUE_TRANSITION_ID = 'IssueTransitionId', LINK_TYPE = 'linkType', and additional fields covering summary, type, assignee, components, watchers, link type, and work-log minutes. Because none of these strings carry the protected prefix, the filter treats them as ordinary application headers and passes them unmodified through the HTTP boundary into the Exchange. The camel-jira producers then consume these Exchange headers to determine the target JIRA resource and the operation to perform, using the service account credentials configured on the jira: endpoint. This is classified as CWE-20 (Improper Input Validation) - the component fails to verify that header values originate from a trusted internal route source rather than the untrusted HTTP boundary - and CWE-639 (Authorization Bypass Through User-Controlled Key) - the attacker directly controls IssueKey and ProjectKey, selecting which JIRA resource is operated upon. The fix renames all JiraConstants string values to the CamelJira* convention (e.g., 'IssueKey' becomes 'CamelJiraIssueKey'), so they fall within the protected Camel namespace and are blocked at the HTTP boundary like every other Camel control header. Java field names in JiraConstants are unchanged, so code using the constants compiles without modification; only routes setting headers by raw string value or using Endpoint DSL accessor names require updates.