Apache Camel CVE-2026-59230

Exploitation requires that the target Camel route uses the camel-mail component's MimeMultipart data format with headersInline explicitly configured to true - this is not the default, and routes using the default setting of false are not reachable by this vulnerability. The attacker must be able to influence the MIME header names and values of messages processed by the route, either by sending mail directly to an address the Camel consumer monitors or via a mail relay in the ingestion path. Actual impact further depends on what Camel producers or processors follow the unmarshal step: injection of CamelSqlQuery into a route terminating in camel-sql enables SQL redirection, while a route with no header-driven control logic may suffer no meaningful consequence. Exploitation is bounded by the non-default configuration requirement and the route topology; there is no privilege requirement to send email, but the non-default headersInline setting is a prerequisite outside the attacker's control.

The NVD CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5 and treats the attack complexity as low, which is accurate conditional on headersInline being enabled but overstates the population-level risk since that setting is non-default. The EPSS score of 0.16% (5th percentile) and SSVC exploitation status of none both corroborate that no exploitation activity has been observed. SSVC rates the vulnerability as automatable - once a route is exposed, crafting and sending malicious MIME messages requires no per-target friction - with only partial technical impact, because actual consequences are entirely dependent on which Camel components follow the unmarshal step. A route that pipes to camel-sql could be redirected to execute attacker-supplied SQL; a route performing only fixed transformations may experience no meaningful impact. There is no conflict between the CVSS network vector and the description - email senders are genuinely remote and unauthenticated - but the non-default configuration prerequisite is a real limiting factor that the AC:L rating does not fully capture. Overall risk profile: real vulnerability, meaningful impact in affected configurations, but the limited deployment footprint of routes with headersInline=true and zero observed exploitation keep this firmly in scheduled-patching territory rather than emergency response.

An attacker who can deliver email to a Camel route using camel-mail with headersInline=true crafts a MIME message containing a header named CamelSqlQuery with an attacker-controlled SQL statement. When the route unmarshals the message, the header bypasses filtering and is copied to the Camel Exchange; the downstream camel-sql producer then executes the injected query against the configured database rather than its own configured statement. No public exploit code has been identified at time of analysis, but the attack is straightforward to reproduce from the published advisory description alone.