CVE-2026-49086: Apache Camel DAPR Message Routing Vulnerability

Technical summary

The vulnerability stems from improper handling of CloudEvent metadata in the DaprPubSubConsumer. Two fields—the Pub/Sub component name and topic—are extracted from inbound CloudEvents and placed into CamelDaprPubSubName and CamelDaprTopic Exchange headers. However, these headers are producer-direction routing headers; when DaprConfigurationOptionsProxy processes outbound messages through a Dapr producer, it reads these headers and grants them priority over the endpoint's configured destination. This creates a confused deputy scenario where untrusted data from inbound messages influences outbound routing decisions. An attacker who can publish to the subscribed topic can set arbitrary values in the CloudEvent's pub/sub-name and topic fields, causing the route to republish the message to a destination of the attacker's choice rather than the route's intended target.

Business impact

Routes that use Camel DAPR components to process and republish messages between topics risk message interception, redirection, and data exfiltration. An attacker with publish access to any subscribed topic can silently redirect sensitive messages to alternative destinations, potentially exposing them to unauthorized parties or causing messages intended for processing by one component to be delivered to another. This undermines message routing integrity and topic-level access control enforcement in Dapr Pub/Sub brokers, particularly in multi-tenant or security-sensitive messaging architectures where topic isolation is a key control.

Affected systems

Apache Camel versions 4.12.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are affected. The vulnerability is introduced in version 4.12.0 and is fixed in 4.21.0 (general release stream), 4.14.8 (4.14.x LTS), and 4.18.3 (4.18.x stream). Deployments using DAPR Pub/Sub consumers that republish messages to other topics or components are at risk.

Exploitability

Exploitation is straightforward and requires only network-accessible publish permissions to the topic the Camel route subscribes to. No authentication bypass, user interaction, or complex attack chain is needed. The attacker simply publishes a CloudEvent with malicious pub/sub-name and topic values. CVSS 3.1 score of 6.5 (MEDIUM) reflects the low barrier to exploitation (network accessible, no privileges required) and moderate impact (confidentiality and integrity of message routing). The vulnerability is not currently tracked in the CISA KEV catalog.

Remediation

Upgrade to Apache Camel 4.21.0, 4.14.8 (for 4.14.x LTS users), or 4.18.3 (for 4.18.x users). For environments unable to patch immediately, implement a workaround by explicitly removing the CamelDaprPubSubName and CamelDaprTopic headers from the Exchange between the Dapr consumer and any Dapr producer in the route. Additionally, restrict publish access to subscribed Dapr Pub/Sub topics to only trusted producers, limiting the blast radius if the vulnerability is exploited before patching.

Patch guidance

Consult the Apache Camel project's official release notes and security advisory to confirm the exact patched versions for your release stream. For users on the 4.14.x LTS stream, upgrade to version 4.14.8 or later. For the 4.18.x stream, upgrade to 4.18.3 or later. For other releases, upgrade to 4.21.0 or a newer version. Test patches in a non-production environment before deploying to production to ensure compatibility with custom extensions and message processing logic.

Detection guidance

Review Camel route configurations that use camel-dapr consumers feeding into camel-dapr producers (patterns like from('dapr-pubsub:...').to('dapr-pubsub:...')). Enable detailed audit logging on Dapr Pub/Sub message delivery to detect unexpected message routing to off-configuration destinations or topics. Monitor CloudEvent attributes and Exchange headers in Camel message processing pipelines for suspicious or unexpected routing field values. If currently vulnerable, watch for messages arriving at topics or components not specified in route definitions.

Why prioritize this

Prioritize patching based on whether your deployment uses DAPR Pub/Sub routing logic and whether untrusted parties can publish to subscribed topics. If your Camel routes republish messages between Dapr topics and the originating topic is accessible to external or less-trusted publishers, exploitation risk is elevated. In architectures where all publishers are trusted or internal, risk is lower but should still be addressed during a regular patching window.

Risk score, explained

CVSS 3.1 6.5 MEDIUM is justified by the low attack complexity (network accessible, no special privileges) and straightforward exploitation, balanced against the fact that impact is scoped to message routing and confidentiality/integrity rather than system availability or remote code execution. The vulnerability creates a genuine security gap for organizations relying on topic-level access controls and message isolation.

Frequently asked questions