Apache Camel EUVD-2026-41839

Exploitation requires a Camel route that bridges an HTTP-facing consumer (e.g. platform-http, camel-jetty, servlet) into a mongodb-gridfs: producer where the endpoint's operation parameter is NOT set - which is the default, so the producer reads its operation from the gridfs.operation header. The attacker must be able to reach that HTTP consumer and set arbitrary request headers; no credentials are needed only when that bridging consumer is itself unauthenticated. Limiting factors that reduce real-world risk: the mongodb-gridfs component must actually be in use, the producer's operation must be left unset, and the HTTP ingress must be untrusted/unauthenticated and not already stripping gridfs.* headers - if an explicit operation is configured, or the ingress requires auth or filters these headers, the override cannot occur.

Signals conflict and must be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the SSVC assessment (automatable: yes, technical impact: total) argue for high priority: where a vulnerable route exists, exploitation is network-based, needs no credentials, and yields read, delete and enumeration of the GridFS bucket plus NoSQL operator injection. Against that, EPSS is only 0.16% (6th percentile), SSVC exploitation status is 'none', and no public exploit or KEV listing exists - consistent with the fact that exploitation is not against a bare default install but requires a specific deployment pattern (an unauthenticated HTTP consumer bridged into a mongodb-gridfs producer with no explicit operation). The 9.8 base score does not capture this configuration dependency, so real-world exposure is narrower than the number implies: treat it as high priority for shops running Camel HTTP-to-GridFS routes, and lower for those who do not use that component or who pin the operation. No conflict exists between the CVSS network vector and the description - both agree on remote, unauthenticated access given the bridging route.

An application exposes a platform-http endpoint that forwards uploads into a mongodb-gridfs: producer with no operation set. An unauthenticated attacker sends an HTTP request carrying gridfs.operation: remove and gridfs.objectid: <target> to delete an arbitrary stored file, or gridfs.operation: listAll to enumerate the entire bucket, and can supply a crafted gridfs.metadata value to inject MongoDB operators. No public POC is currently identified, but the attack is simple to script given AV:N/AC:L/PR:N.