Apache Camel EUVD-2026-104204

Exploitation requires a non-default, developer-introduced condition: an Apache Camel route must define a platform-http endpoint whose configured path begins with the five characters 'proxy' (such as proxyStats, proxy-health, or proxying) but is not meant to be the documented platform-http:proxy endpoint. Only such endpoints are wrongly promoted to proxy mode, where getPath() returns '/' (making them catch-all) and VertxPlatformHttpConsumer.handleProxy() takes the forward target from the request's own Host header. Limiting factors: endpoints beginning with a leading slash (platform-http:/proxy) are NOT affected; default deployments with no proxy-prefixed endpoints are not exploitable; the issue is confined to Apache Camel versions 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 using the camel-platform-http component. The dependence on a specific operator naming choice is what drives the high attack complexity.

CVSS 3.1 base score is 4.8 (medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) and only partial confidentiality/integrity impact. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the intelligence set, so there is no signal of active or probable exploitation. The AC:H rating is the dominant real-world mitigator: exploitation is not against a default state but depends entirely on a developer having created an Apache Camel platform-http endpoint whose path happens to begin with the literal string 'proxy' (e.g. proxyStats, proxy-health, proxying) without intending it to be a proxy. The reporter is the vendor (apache) and a patch exists, which is consistent with a responsibly-disclosed hardening fix rather than an in-the-wild issue. Net assessment: a genuine request-forgery/SSRF-class weakness worth patching, but a low-to-medium real priority rather than an emergency - the combination of AC:H, a required non-default endpoint-naming precondition, and absence of EPSS/KEV/POC signals argues against widespread opportunistic exploitation. No key CVSS signal conflicts with the description; the AC:H rating correctly reflects the config-dependent precondition described.

A developer names a Camel platform-http endpoint 'proxyStats' (or similar) to serve its own status content; because proxy mode was selected by prefix match, that endpoint silently becomes a catch-all proxy that forwards requests to the target named in the incoming request's own Host header. A remote caller then sends requests through that endpoint with a crafted Host header to make the server relay traffic to internal systems it would not otherwise reach. No public exploit identified at time of analysis.