What is the CVSS score of CVE-2026-48206?

CVE-2026-48206 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel JIRA are affected by CVE-2026-48206?

Apache Camel's camel-jira component (versions 4.0.0-4.20.x) contains an authorization bypass vulnerability allowing unauthenticated attackers to perform arbitrary JIRA operations-including deleting…. A patch is available.

How to fix or mitigate CVE-2026-48206?

24 hours: Identify all production instances of Apache Camel 4.0.0-4.20.x with camel-jira endpoints exposed to HTTP consumers. 7 days: Upgrade to Apache Camel 4.14.8, 4.18.3, or 4.21.0 (select based on your current release line) and validate JIRA connectivity post-deployment. 30 days: Query JIRA audit logs for anomalous issue creation, deletion, field modifications, or access patterns during the vulnerability exposure window.

Apache Camel JIRA CVE-2026-48206

EUVD-2026-41841 MEDIUM

Improper Input Validation (CWE-20)

2026-07-05

GHSA-64gv-6cq2-45jr

Atlassian Microsoft Apache Authentication Bypass Camel

5.3

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

9.3 CRITICAL

Network-delivered via plain HTTP headers; no attacker credentials needed when the consumer is unauthenticated; scope changes to the downstream JIRA instance with low confidentiality and high integrity impact from arbitrary issue manipulation.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:41 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Authorization bypass in Apache Camel's camel-jira component (versions 4.0.0 through pre-4.21.0) allows unauthenticated HTTP clients - in routes that bridge an HTTP consumer to a jira: producer - to drive arbitrary JIRA issue operations using the endpoint's configured service-account credentials, including deleting or transitioning issues, creating issues in unauthorized projects, modifying fields, and manipulating watchers. The root cause is that JIRA control header constants (IssueKey, ProjectKey, IssueTransitionId, linkType, and others) use non-Camel-prefixed string values, bypassing the HttpHeaderFilterStrategy which only guards the 'Camel/'/'camel' header namespace at the HTTP boundary. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify reachable Camel HTTP consumer endpoint

Delivery

Determine valid JIRA issue/project keys

Exploit

Craft HTTP request with JIRA control headers (IssueKey, ProjectKey, IssueTransitionId)

Execution

Headers bypass HttpHeaderFilterStrategy (non-Camel prefix)

Persist

Headers propagate into Camel Exchange unmodified

Impact

JIRA producer executes arbitrary operation with configured service-account credentials

Access

Identify reachable Camel HTTP consumer endpoint

Delivery

Determine valid JIRA issue/project keys

Exploit

Craft HTTP request with JIRA control headers (IssueKey, ProjectKey, IssueTransitionId)

Execution

Headers bypass HttpHeaderFilterStrategy (non-Camel prefix)

Persist

Headers propagate into Camel Exchange unmodified

Impact

JIRA producer executes arbitrary operation with configured service-account credentials

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions to all be true simultaneously. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector was provided by the Apache Camel security team or NVD at time of analysis; the vulnerability is designated MODERATE severity by the project. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker identifies a publicly reachable Apache Camel platform-http endpoint that bridges to a jira: producer in an enterprise integration environment. They send an HTTP POST request augmented with headers 'IssueKey: SEC-412' and 'IssueTransitionId: 31', which pass through HttpHeaderFilterStrategy unfiltered and propagate into the Exchange, causing the JIRA producer to transition issue SEC-412 to 'Resolved' using the service account's credentials - with no authentication from the attacker. …
Remediation	Upgrade to Apache Camel 4.14.8 (for users on the 4.14.x LTS stream), 4.18.3 (for users on the 4.18.x stream), or 4.21.0 (latest), as confirmed by the Apache Camel security advisory at https://camel.apache.org/security/CVE-2026-48206.html. … Detailed patch versions, workarounds, and compensating controls in full report.