What is the CVSS score of CVE-2026-55993?

CVE-2026-55993 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-55993?

Apache Camel's WebSocket component (versions 4.0.0-4.20.x) contains a server-side request forgery vulnerability that allows unauthenticated attackers to hijack internal HTTP requests and exfiltrate…. A patch is available.

How to fix or mitigate CVE-2026-55993?

Within 24 hours: Inventory all systems running Apache Camel with camel-atmosphere-websocket components and identify any WebSocket endpoints exposed without authentication. Within 7 days: Update to patched Apache Camel releases (affected versions: 4.0.0-4.14.7, 4.15.0-4.18.2, 4.19.0-4.20.x; consult vendor security advisory for latest patched versions for your version line) or implement authentication and network-level access controls on all WebSocket endpoints. Within 30 days: Verify patched version deployment across all production and non-production environments and review access logs for exploitation attempts targeting WebSocket endpoints.

Apache Camel CVE-2026-55993

EUVD-2026-41849 HIGH

Improper Input Validation (CWE-20)

2026-07-05

GHSA-rcvm-6r79-cf4r

Apache SSRF Microsoft Hashicorp Camel

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable header injection when the WebSocket endpoint is unauthenticated (PR:N/AV:N/AC:L); primary impact is secret disclosure (C:H) with no direct integrity or availability change to the Camel host (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 07, 2026 - 13:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 07, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 07, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Jul 07, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:24 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.apache.camel:camel-atmosphere-websocket (2 direct, 4 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 4

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026

AnalysisAI

Server-side request forgery and secret disclosure in Apache Camel's camel-atmosphere-websocket component allow a remote attacker to hijack downstream server-side HTTP requests by injecting Camel control headers as WebSocket query parameters. Affecting Camel 4.0.0-4.14.7, 4.15.0-4.18.2 and 4.19.0-4.20.x, the flaw lets an attacker set CamelHttpUri to redirect internal HTTP calls (e.g., to cloud metadata endpoints) and force resolution of Camel property placeholders, leaking environment variables, application properties and vault secrets. Where the WebSocket endpoint is exposed without authentication the issue is unauthenticated (CVSS 7.5); there is no public exploit identified at time of analysis and EPSS is low (0.24%).

Technical ContextAI

The affected technology is Apache Camel, a Java enterprise integration framework, specifically its Atmosphere-based WebSocket consumer (camel-atmosphere-websocket). Root cause is CWE-20 Improper Input Validation: WebsocketConsumer.service() collects the inbound WebSocket query-string map, and WebsocketConsumer.sendEventNotification() copies every entry directly into the Camel Exchange header map without applying any HeaderFilterStrategy. Because the Camel header namespace is not filtered, externally supplied parameters can populate Camel-internal control headers such as CamelHttpUri (Exchange.HTTP_URI). When such a route feeds a downstream HTTP producer, that producer honors the attacker-set URI and additionally resolves Camel property placeholders on it - turning header injection into both SSRF and secret disclosure. The EUVD tracks this as EUVD-2026-41849; tags (Apache, SSRF, Microsoft, Hashicorp) reflect that the leaked targets include cloud metadata services and HashiCorp Vault references.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.21.0, which fixes the issue; users on the 4.14.x LTS stream should move to 4.14.8, and users on the 4.18.x stream should move to 4.18.3 (per https://camel.apache.org/security/CVE-2026-55993.html). The fix makes the consumer apply the inherited HeaderFilterStrategy, filtering the Camel* / camel* namespace case-insensitively so externally supplied Camel headers are no longer copied into the Exchange. If you cannot upgrade immediately, strip the control headers at the start of the route with removeHeaders('Camel*') and removeHeaders('camel*') before any downstream producer runs (side effect: any legitimately intended Camel headers on that path are also dropped), require authentication on the WebSocket endpoint (side effect: breaks anonymous WebSocket clients), and avoid bridging an untrusted WebSocket consumer directly into an HTTP producer whose target URI can be driven from message headers. Do not rely on placeholder-bearing URIs in header-influenced routes, since placeholder resolution is part of the leak.