CVE-2026-49098: Apache Camel Kafka Header Injection Vulnerability (MEDIUM)

Technical summary

The vulnerability stems from inconsistent header-filtering strategies across Camel's bridge components. The camel-kafka producer evaluates runtime topic selection by preferring the kafka.OVERRIDE_TOPIC Exchange header over the configured endpoint topic in KafkaProducer.evaluateTopic(). While KafkaHeaderFilterStrategy filters kafka.* headers at the Kafka serialization boundary, it does not apply to headers arriving from upstream consumers. HttpHeaderFilterStrategy, used by HTTP consumers, only blocks the Camel/camel namespace, leaving kafka.* headers unfiltered. In multi-component routes, this allows kafka.OVERRIDE_TOPIC, kafka.OVERRIDE_TIMESTAMP, and kafka.PARTITION_KEY headers to propagate from the HTTP ingress to the Kafka producer, enabling message redirection, backdating, and partition targeting without credential validation.

Business impact

This vulnerability enables attackers to misdirect critical business messages, inject malicious payloads into downstream systems that consume specific Kafka topics, or corrupt message ordering and timing. Organizations using HTTP-to-Kafka bridging patterns in Camel are at risk of data integrity compromises, operational disruption, and potential compliance violations if sensitive topics are targeted. The low barrier to exploitation (no credentials required, standard HTTP request) increases the practical business risk, especially for internet-facing or multi-tenant deployments.

Affected systems

Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x are vulnerable. Systems are affected only if they deploy Camel routes that bridge HTTP consumers (platform-http, jetty, servlet) directly into Kafka producers. LTS stream users on 4.14.x and standard stream users on 4.18.x are in scope for targeted patching.

Exploitability

Exploitability is high for affected deployments. No authentication is required; an attacker simply includes a kafka.OVERRIDE_TOPIC header in an HTTP POST or GET request to a bridging route. The attack is trivial to execute with any HTTP client and requires only knowledge of the HTTP endpoint URL and the existence of a downstream Kafka topic name. However, the vulnerability is confined to deployments using the specific HTTP-to-Kafka pattern; standalone Kafka producers or routes without HTTP consumers are unaffected.

Remediation

Upgrade to Apache Camel 4.21.0 (all streams), 4.18.3 (4.18.x stream), or 4.14.8 (4.14.x LTS stream). After upgrading, audit Camel routes for direct references to old kafka.* header names and migrate them to CamelKafka*-prefixed names (e.g., CamelKafkaOverrideTopic). For immediate mitigation pending upgrade, add a removeHeaders('kafka.*') filter at the start of any HTTP-to-Kafka bridging route to strip untrusted kafka.* headers before they reach the producer.

Patch guidance

Apply the version-specific patches: version 4.21.0 for the mainline release, 4.18.3 for the 4.18.x stream, or 4.14.8 for the 4.14.x LTS stream. Verify patch availability and compatibility with your deployment's Java version and other Camel components. After patching, test bridging routes in a staging environment to confirm that any existing kafka.* header usage is migrated to the CamelKafka* namespace; otherwise, routes may fail to read or write headers as expected. Check the Apache Camel release notes for any additional breaking changes in your target version.

Detection guidance

Monitor Camel application logs and metrics for kafka.OVERRIDE_TOPIC, kafka.OVERRIDE_TIMESTAMP, and kafka.PARTITION_KEY headers arriving via HTTP requests. Enable Exchange header tracing on HTTP-to-Kafka routes to capture inbound headers. Look for unexpected topic names appearing in Kafka producer logs or audit trails. Network-level detection is difficult; focus on application-level logging and Kafka broker audit logs to identify message publications to unexpected topics. Compare the configured topic name against the actual destination topic in Kafka broker logs for routes suspected of bridging HTTP and Kafka.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the practical risk is elevated for affected organizations due to the ease of exploitation, the absence of authentication requirements, and the high impact on message integrity and system confidentiality. Prioritize patching for any internet-facing or multi-tenant Camel deployments that use HTTP-to-Kafka bridging. If patching is delayed, implement the interim header-stripping mitigation immediately.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects low complexity attack vector (network accessible, no authentication, no user interaction), but limited impact scope (confidentiality affected, no integrity or availability impact in the base vector). The score does not fully capture the business risk of message redirection and injection into downstream systems, which may have higher impact depending on the sensitivity of consumed topics and downstream service dependencies. Organizations should apply contextual risk assessment based on the criticality of their Kafka topics and the degree of trust in upstream HTTP clients.

Frequently asked questions