Apache Camel Knative EUVD-2026-64960

Exploitation requires all of the following: (1) The target Camel application uses the camel-knative component as a consumer - deployments not using Knative eventing are not affected. (2) The attacker can send HTTP POST requests to the Knative consumer endpoint - in typical Knative deployments this endpoint is cluster-internal, but misconfigured or externally exposed ingress paths increase exposure. (3) The route forwards messages from the Knative consumer to a header-driven component such as camel-http (using CamelHttpUri/CamelHttpPath) or camel-file (using CamelFileName) - routes that only log or transform events without forwarding to such components are not vulnerable to SSRF or path traversal, though dispatch redirection may still apply. (4) Structured content mode is used - binary content mode is NOT vulnerable because KnativeHttpHeaderFilterStrategy is correctly applied on that path. Exploitation is limited by the specificity of the Knative component usage and the requirement for downstream header-sensitive routing; organizations using camel-knative purely as an internal event consumer without header-driven forwarding face substantially reduced risk.

No vendor-supplied CVSS vector or score is present in the input data, so risk signals are limited to the description and patch metadata. The description explicitly identifies the attacker as unauthenticated and the delivery mechanism as an HTTP POST - both of which favor a high-severity rating. EPSS data is absent; KEV status is not listed. The exploitability is constrained by a narrow but realistic precondition: the route must both use the Knative consumer in structured mode AND forward to a header-sensitive component (camel-http, camel-file). Deployments that only consume events internally without forwarding to such components are not directly vulnerable to SSRF or path traversal, though dispatch redirection may still apply. The pattern is part of a documented series of incomplete fixes across Camel components, which suggests the issue class is understood by researchers, increasing likelihood of targeted exploitation. Overall, this represents a high real-world priority for organizations running Apache Camel with Knative-to-HTTP or Knative-to-file routing patterns, and a lower priority for those not using the Knative component.

An attacker who can reach the Knative consumer HTTP endpoint crafts an HTTP POST with Content-Type: application/cloudevents+json and a JSON body containing a CloudEvent with extension fields named 'camelhttpuri' and 'camelhttppath' set to an internal service URL (e.g., http://internal-metadata-service/). When the Camel route processes this event and forwards it to a camel-http component, the injected headers override the configured destination, causing the Camel runtime to issue an outbound HTTP request to the attacker-specified internal URL - classic SSRF. No public exploit code has been identified, but the attack requires only a standard HTTP client capable of sending a JSON-encoded CloudEvent body.