What is the CVSS score of EUVD-2026-41850?

EUVD-2026-41850 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by EUVD-2026-41850?

Apache Camel's iggy consumer (versions 4.17.0-4.18.2 and 4.19.0-4.20.x) contains a vulnerability enabling attackers with Iggy stream publishing access to exfiltrate secrets, database credentials, API…. A patch is available.

How to fix or mitigate EUVD-2026-41850?

24 hours: Conduct inventory of all production instances running Apache Camel versions 4.17.0-4.18.2 or 4.19.0-4.20.x with camel-iggy component; audit and restrict Iggy stream publisher access to authenticated, trusted sources only; review recent publisher activity logs for unauthorized access. 7 days: Procure and stage patched Apache Camel version per vendor advisory; complete testing in non-production environment to validate camel-iggy functionality. 30 days: Deploy patched version to production infrastructure and verify successful operation.

Apache Camel EUVD-2026-41850

| CVE-2026-55994 HIGH

Improper Input Validation (CWE-20)

2026-07-05

GHSA-pw9q-pq7c-rfqw

Apache SSRF Microsoft Hashicorp Camel

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Exploitation needs a specific Iggy-to-HTTP-producer route plus publish access to the stream, so AC:H; publish access may be unauthenticated (PR:N); high secret disclosure (C:H) with limited SSRF-driven integrity (I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 22:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 22:22 NVD

7.5 (HIGH)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.camel:camel-iggy (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 4.17.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Server-side request forgery and secret disclosure in the Apache Camel camel-iggy consumer (versions 4.17.0-4.18.2 and 4.19.0-4.20.x) allow an actor able to publish to a consumed Iggy stream to inject Camel control headers such as CamelHttpUri into the Exchange. When the consumer feeds a downstream HTTP producer, the attacker redirects the server-side request to internal services or cloud metadata endpoints, and because the producer resolves Camel property placeholders on the attacker-controlled URI, environment variables, application properties, and vault secrets are exfiltrated. No public exploit identified at time of analysis, and EPSS is low (0.15%), but the confidentiality impact is rated High.

Technical ContextAI

Apache Camel is a widely used Java integration framework whose components bridge messaging systems to other transports. The affected component, camel-iggy, is a consumer/producer for the Iggy message-streaming platform. The root cause is CWE-20 (Improper Input Validation): IggyFetchRecords copied inbound Iggy message user-headers directly into the Camel Exchange header map without applying a HeaderFilterStrategy. Camel uses reserved 'Camel*' header names (e.g., Exchange.HTTP_URI = CamelHttpUri) as internal control metadata that downstream producers act upon, so failing to filter the Camel namespace on ingress lets externally-supplied data masquerade as trusted internal control headers - enabling both SSRF and, via placeholder resolution on the resulting URI, exposure of sensitive information to an unauthorized actor.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.21.0, or for the 4.18.x maintenance stream upgrade to 4.18.3, both of which introduce a dedicated IggyHeaderFilterStrategy (and a headerFilterStrategy endpoint option) that case-insensitively filters the Camel header namespace on inbound mapping so externally-supplied Camel*/camel* headers are no longer copied into the Exchange (see https://camel.apache.org/security/CVE-2026-55994.html). For deployments that cannot upgrade immediately, strip the Camel control headers before they reach any downstream producer by placing removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route (side effect: legitimately propagated Camel headers on that route are also dropped), restrict who can publish to the consumed Iggy stream/topic, and avoid bridging an untrusted Iggy consumer directly into an HTTP producer whose target URI can be driven from message headers.