CVE-2026-46585: Apache Camel Lucene Query Injection and Authorization Bypass

Technical summary

The camel-lucene producer component reads search queries from Exchange headers named QUERY and RETURN_LUCENE_DOCS. Because these header names do not follow Camel's internal naming convention (no 'Camel' or 'camel' prefix), the HttpHeaderFilterStrategy fails to filter them at the HTTP boundary. An HTTP request can therefore directly set these headers, which are passed through to the Lucene producer without validation. In routes where HTTP consumers (such as platform-http) feed directly into Lucene operations, this allows external callers to override the intended query logic. Depending on indexed content and route design, this enables unauthorized document retrieval or causes denial-of-service through expensive regex queries. The vulnerability stems from improper input validation (CWE-20) combined with an authorization bypass mechanism tied to user-controlled keys (CWE-639).

Business impact

Organizations using Apache Camel to expose full-text search capabilities over HTTP face exposure of sensitive indexed data—potentially customer records, internal documents, or confidential information—without authentication or audit. Attackers can extract complete indexes through match-all queries or craft expensive regular-expression searches to degrade performance. For data-heavy deployments, this represents both a confidentiality breach and operational resilience risk. If Lucene indices contain personally identifiable information or regulated data (HIPAA, GDPR), unauthorized access triggers compliance violations and breach notification obligations. The ease of exploitation (no credentials, simple HTTP headers) raises the likelihood of opportunistic attacks.

Affected systems

Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are affected. Specifically, patched versions are 4.14.8 (LTS), 4.18.3, and 4.21.0. Only deployments that combine the camel-lucene producer with an HTTP consumer endpoint are vulnerable; isolated Lucene integrations not exposed via HTTP are unaffected. The vulnerability applies regardless of the HTTP consumer implementation (platform-http, jetty, servlet, etc.) as long as the route path leads from HTTP input to Lucene query execution.

Exploitability

Exploitation requires only network access to the affected HTTP endpoint and knowledge of the internal header names (QUERY and RETURN_LUCENE_DOCS), which are documented in Camel's codebase and easily discoverable. No authentication, special privileges, or user interaction are required. Attack complexity is low: an attacker simply crafts an HTTP request with the malicious header and observes results. Public or internet-facing Camel instances are immediately at risk. The CVSS 3.1 score of 7.5 (High) reflects the high confidentiality impact (documents exposed) and network accessibility, balanced by absence of integrity or availability impact in the base case, though denial-of-service is possible with carefully crafted queries.

Remediation

Upgrade to Apache Camel 4.21.0, 4.18.3, or 4.14.8 depending on your release stream. After upgrading, refactor routes to use the corrected header names: CamelLuceneQuery instead of QUERY, and CamelLuceneReturnLuceneDocs instead of RETURN_LUCENE_DOCS. These prefixed names are properly filtered by HttpHeaderFilterStrategy. Organizations unable to upgrade immediately should implement a workaround: at the start of affected routes, strip the vulnerable headers (removeHeader('QUERY'), removeHeader('RETURN_LUCENE_DOCS')) and set the query from a trusted, non-user-controlled source (e.g., constant values, database lookups, or configuration). Test workarounds to ensure the route still functions correctly.

Patch guidance

Verify the current Apache Camel version in your runtime environment and dependency manifests. For LTS users on 4.14.x, target 4.14.8 or later. For users on 4.15.x through 4.18.x, target 4.18.3 or later. For users on 4.19.x and 4.20.x, target 4.21.0 or later. Review the official Apache Camel release notes to confirm patch availability in your distribution channel (Maven Central, vendor releases, etc.). Schedule testing in a non-production environment first; confirm that any routes using the old header names are updated to use the Camel-prefixed variants. Rolling patches in high-availability deployments should follow your standard change control; no data migration is required.

Detection guidance

Monitor HTTP logs and Camel route traces for inbound requests that set the QUERY or RETURN_LUCENE_DOCS headers. Web Application Firewalls (WAF) can block or flag HTTP headers with those exact names before they reach the application. In Camel itself, enable debug logging on the camel-lucene component to observe which queries are executed and their origins; anomalous queries (particularly match-all patterns, regex-intensive searches, or unexpected user IDs) warrant investigation. If Lucene indices are accessed via audit logging, review for queries executed without corresponding application requests. Correlation of HTTP request headers with Lucene execution logs can reveal header-injection attempts. For threat hunting, search logs for regex patterns in the QUERY header value that correlate with unexpected CPU spikes on the Lucene indexing process.

Why prioritize this

This vulnerability merits immediate patching due to its high CVSS score (7.5), ease of exploitation (network-accessible, no authentication), and direct exposure of potentially sensitive indexed data. The lack of integrity or availability guarantees in the base case is offset by the authentication bypass mechanism, which violates fundamental security principles. Organizations handling regulated data or operating public-facing search services should treat this as critical. However, enterprises running isolated, non-HTTP-exposed Lucene integrations can defer patching with lower risk.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: Attack Vector Network (AV:N) due to HTTP accessibility, Attack Complexity Low (AC:L) because no special conditions are required, Privileges Required None (PR:N) as no authentication is checked, User Interaction None (UI:N) because the attack is fully automated, Scope Unchanged (S:U) as the vulnerability affects only the Lucene component in isolation, Confidentiality High (C:H) because unauthorized document disclosure is the primary impact, Integrity None (I:N) because the attacker cannot modify indexed documents, and Availability None (A:N) in the base vector, though resource exhaustion is possible in practice. The score correctly captures the severity of data exposure without overstating impact on system integrity or uptime.

Frequently asked questions