Apache Camel EUVD-2026-104202

Exploitation requires a Camel route that unmarshals an externally-supplied multipart MIME message using the camel-mail MimeMultipart data format with inline headers (headersInline), where the resulting Exchange is subsequently passed to a mail producer. The attacker must be able to deliver a MIME message whose headers include mail.smtp.* or mail.smtps.* names (e.g., mail.smtp.host, mail.smtps.auth); these sit outside the Camel* namespace that consumer filters block, so pre-fix they were copied onto the Exchange and influenced how the downstream producer connects and sends. Limiting factors: the vulnerable data-format-then-producer topology is a specific, non-default configuration; deployments without the MimeMultipart unmarshal path or without a downstream mail producer are not exposed. The documented mitigation (removeHeaders("mail.smtp*") before the producer) also neutralizes it without upgrading.

The vendor CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) presents this as a network-reachable, unauthenticated, low-complexity issue with low confidentiality and integrity impact and no availability impact - the PR:N reflects that a crafted message from an external sender triggers it without authentication. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT in CISA KEV and no proof-of-concept or exploit code is referenced, so this is no public exploit identified at time of analysis. Crucially, the raw AV:N/AC:L/PR:N vector overstates practical risk: the flaw is only reachable in deployments that unmarshal externally-supplied multipart MIME with the MimeMultipart data format (headersInline) AND then feed a downstream mail producer - a specific, non-default route topology, not an out-of-the-box exposure. This is an incomplete-fix follow-up to CVE-2026-46584, so the real priority is moderate and conditional: organizations that patched the prior CVE and run the affected route pattern should treat it as a genuine gap, but it is not a broad, wormable, high-urgency issue. Conflicting signal to note: the vector implies default remote exploitability, whereas the description makes clear a particular data-format-plus-producer configuration is required - verify your routes before deprioritizing or over-prioritizing.

An external sender submits a crafted multipart MIME message to a Camel route that unmarshals it with the MimeMultipart data format and subsequently calls a mail producer. Because the unmarshal path copied mail.smtp.* / mail.smtps.* headers onto the Exchange without filtering, the attacker injects headers such as mail.smtp.host that override the producer's SMTP session properties, redirecting outbound mail to an attacker-controlled server and potentially leaking credentials or message content. No public exploit identified at time of analysis; the attack requires only crafting message headers (AV:N/AC:L), but depends on the vulnerable route configuration.