What is the CVSS score of CVE-2026-49097?

CVE-2026-49097 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel IRC are affected by CVE-2026-49097?

Apache Camel deployments with IRC integration components face an unauthenticated message hijacking vulnerability: attackers can redirect outgoing IRC communications to arbitrary channels or…. A patch is available.

How to fix or mitigate CVE-2026-49097?

Within 24 hours: Identify all production systems running Apache Camel versions 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x with camel-irc components. Within 7 days: Upgrade to patched versions (4.14.8, 4.18.3, or 4.21.0 depending on your current major version branch). Within 30 days: Audit IRC message logs for anomalous routing, review network access controls to IRC bridge endpoints, and validate proper header filtering in all affected systems.

Apache Camel IRC CVE-2026-49097

EUVD-2026-41843 MEDIUM

Improper Input Validation (CWE-20)

2026-07-05

GHSA-463m-2hr2-q2j7

Microsoft Apache Information Disclosure Camel

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-delivered HTTP header injection with no auth required; scope changed as attack crosses HTTP-to-IRC boundary; limited confidentiality and integrity impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 06, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:36 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Header injection in Apache Camel's camel-irc component enables unauthenticated HTTP clients to redirect outgoing IRC messages to attacker-chosen channels or users by supplying non-Camel-prefixed headers (e.g., irc.sendTo) that Camel's HttpHeaderFilterStrategy fails to block. Affected versions span 4.0.0-4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.x; fixes are available in 4.14.8, 4.18.3, and 4.21.0. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send HTTP request with irc.sendTo header set to attacker channel

Delivery

HttpHeaderFilterStrategy passes non-Camel-prefixed header unblocked

Exploit

Header propagates into Camel Exchange unmodified

Execution

IRC producer reads irc.sendTo override, ignores configured channel

Persist

Message delivered to attacker-controlled IRC destination

Impact

Sensitive route payload exfiltrated or injected under bot identity

Access

Send HTTP request with irc.sendTo header set to attacker channel

Delivery

HttpHeaderFilterStrategy passes non-Camel-prefixed header unblocked

Exploit

Header propagates into Camel Exchange unmodified

Execution

IRC producer reads irc.sendTo override, ignores configured channel

Persist

Message delivered to attacker-controlled IRC destination

Impact

Sensitive route payload exfiltrated or injected under bot identity

Vulnerability AssessmentAI

Exploitation	Exploitation requires two simultaneous deployment conditions: first, a Camel route must use an HTTP consumer component (such as platform-http, camel-servlet, or camel-jetty) as its entry point; and second, that same route must connect to an irc: producer endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No NVD CVSS vector or EPSS score was published for this CVE at time of analysis; Apache rated it 'moderate' severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends an HTTP POST to an unauthenticated Camel HTTP consumer endpoint with the custom header 'irc.sendTo: #exfil-channel' appended to the request. The HttpHeaderFilterStrategy passes this header through unchallenged, it enters the Camel Exchange, and the downstream IRC producer reads it as an override, delivering the message body - which may contain sensitive integration data - to the attacker's IRC channel instead of the intended configured destination. …
Remediation	The primary fix is to upgrade camel-irc to 4.14.8 (for 4.14.x LTS users), 4.18.3 (for 4.18.x users), or 4.21.0 (for users on the latest stream), as documented in the vendor advisory at https://camel.apache.org/security/CVE-2026-49097.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all production systems running Apache Camel versions 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x with camel-irc components. …

Threat intelligence, references, and detailed analysis are available after sign-in.