CVE-2026-46453: Apache Camel Elasticsearch Header Injection Authorization Bypass

Technical summary

The camel-elasticsearch-rest-client component accepts five Exchange headers (SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, ID) that control Elasticsearch operation behavior. Unlike all other Camel components, these header constant strings lack the 'Camel' prefix (e.g., they are 'SEARCH_QUERY' rather than 'CamelElasticsearchSearchQuery'). Camel's inbound HttpHeaderFilterStrategy only blocks headers prefixed with 'Camel' or 'camel', allowing unprefixed headers to pass through. When an HTTP endpoint (such as platform-http) feeds a route to an elasticsearch-rest-client producer, untrusted clients can inject these headers to override the route's intended query logic, operation type, and target index. The producer reads all five headers unconditionally and without credential validation, enabling arbitrary Elasticsearch query execution, operation manipulation, and document access.

Business impact

Organizations using Camel to proxy Elasticsearch operations face direct data exposure and integrity risks. An attacker can exfiltrate indexes by issuing match_all queries, delete critical documents, or modify index settings without authentication. Blast radius depends on deployment topology: publicly exposed Camel routes are immediately at risk, while internal services may be vulnerable to lateral movement. Unpatched deployments cannot trust the confidentiality or integrity of data accessed through affected Elasticsearch endpoints. Additionally, incident response and compliance obligations (data breach notification, audit logging) may be triggered if the vulnerability is exploited before detection.

Affected systems

Apache Camel versions 4.3.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are affected. The vulnerability requires both the camel-elasticsearch-rest-client component and an HTTP entry point in the same route (for example, platform-http, jetty, or other HTTP consumers). Only routes that expose Elasticsearch operations via HTTP are at risk; internal point-to-point routes or Elasticsearch clients not exposed to HTTP are unaffected. Check your org's Camel dependency tree and route definitions to identify exposure.

Exploitability

Exploitability is straightforward and requires no authentication. An attacker needs only to craft an HTTP request with malicious header values targeting a Camel route that bridges HTTP and Elasticsearch. Standard HTTP clients or tools (curl, Postman, etc.) suffice; no specialized exploit code is necessary. The attack surface is especially broad in cloud and containerized deployments where Camel routes may be inadvertently exposed. However, the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning active in-the-wild exploitation has not been formally documented at this time.

Remediation

Upgrade to patched versions: 4.14.8 (LTS stream), 4.18.3 (4.18.x stream), or 4.21.0 (latest). The fix renames the header constant string values to include the 'Camel' prefix, causing them to be blocked by the standard HttpHeaderFilterStrategy. Existing code using these headers as Java field names will remain compatible (field names unchanged). For immediate mitigation on unpatched systems, strip the five vulnerable headers from inbound requests before they reach the elasticsearch-rest-client endpoint using Camel's removeHeader() processor, or deploy a custom HeaderFilterStrategy that explicitly blocks 'SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', and 'ID'.

Patch guidance

Verify your current Camel version against the affected ranges (4.3.0–4.14.7, 4.15.0–4.18.2, 4.19.0–4.20.x). Most users should upgrade to 4.21.0 or later. If you maintain 4.14.x LTS releases, upgrade to 4.14.8 or newer. If you are on the 4.18.x stream, upgrade to 4.18.3 or later. Update your Maven or Gradle dependency declaration and retest any routes that consume both HTTP and Elasticsearch. The patched versions are drop-in replacements; no route logic changes are required unless you have written code that explicitly references the old header constant strings (unlikely in practice, as they are typically set implicitly by Camel internals).

Detection guidance

Monitor HTTP access logs for requests containing the five vulnerable header names ('SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', 'ID'). Implement WAF rules that block or flag these headers when transmitted to known Camel Elasticsearch endpoints. Enable Elasticsearch audit logging to detect unexpected match_all queries, delete operations, or index configuration changes originating from the Camel client. Correlate suspicious Elasticsearch operations with HTTP requests received by your Camel routes. In incident response, review Elasticsearch query logs for the publication date (2026-07-06) backward to identify if the vulnerability was exploited before patching.

Why prioritize this

Although assigned a MEDIUM CVSS score (5.3), the practical risk is elevated due to unauthenticated network access, ease of exploitation, and potential for data exfiltration or deletion. Organizations with HTTP-exposed Camel routes to Elasticsearch should prioritize this patch urgently. Mitigations are available for immediate deployment if patching is delayed, reducing but not eliminating risk. The lack of KEV listing suggests controlled disclosure; however, threat actors will likely incorporate this vector once public details circulate.

Risk score, explained

CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible vulnerability requiring no credentials and no user interaction (AV:N, AC:L, PR:N, UI:N). Confidentiality impact is rated Low (C:L) because the attack enables reading Elasticsearch documents but does not automatically expose all data in an organization. Integrity impact is rated None (I:N) in the CVSS model, though in practice the vulnerability does permit deletions and index manipulation—a gap in the scoring. Availability impact is None (A:N). The score does not fully capture the severity of unauthenticated data exfiltration or deletion in production Elasticsearch deployments; security teams should evaluate business context to determine if higher internal priority is warranted.

Frequently asked questions