CVE-2026-40453: Apache Camel RCE Vulnerability

CVE-2026-40453 Overview

CVE-2026-40453 is a critical remote code execution vulnerability in Apache Camel arising from an incomplete security fix for CVE-2025-27636. While the previous fix added case-insensitive filtering to HttpHeaderFilterStrategy, five non-HTTP header filter implementations were left vulnerable to case-variant header injection attacks. These vulnerable components—JmsHeaderFilterStrategy, ClassicJmsHeaderFilterStrategy, SjmsHeaderFilterStrategy, CoAPHeaderFilterStrategy, and GooglePubsubHeaderFilterStrategy—continue to use case-sensitive String.startsWith('Camel'/'camel') filtering while the Camel Exchange stores headers in a case-insensitive map.

This discrepancy allows attackers with JMS (or equivalent) producer access to inject case-variant Camel internal headers such as CAmelExecCommandExecutable, which bypass the filter but are then resolved by downstream components using their canonical casing. This enables remote code execution through components like camel-exec and arbitrary file write through camel-file on vulnerable routes.

Critical Impact

Attackers with producer access to message brokers consumed by Apache Camel routes can achieve remote code execution and arbitrary file write by injecting case-variant internal headers that bypass security filters.

Affected Products

• Apache Camel versions 3.0.0 to 4.14.5
• Apache Camel versions 4.15.0 to 4.18.1
• Apache Camel version 4.19.0

Discovery Timeline

• 2026-04-27 - CVE-2026-40453 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-40453

Vulnerability Analysis

The vulnerability stems from an improper implementation of case sensitivity handling (CWE-178) in multiple header filter strategy components within Apache Camel. When the fix for CVE-2025-27636 was implemented, it correctly addressed the issue in HttpHeaderFilterStrategy by calling setLowerCase(true), ensuring that header names like CAmelExecCommandExecutable would be normalized and filtered alongside CamelExecCommandExecutable.

However, this critical fix was not applied to five other header filter strategy implementations across different Camel modules. The JmsHeaderFilterStrategy and ClassicJmsHeaderFilterStrategy in camel-jms, SjmsHeaderFilterStrategy in camel-sjms, CoAPHeaderFilterStrategy in camel-coap, and GooglePubsubHeaderFilterStrategy in camel-google-pubsub all continue to perform case-sensitive string matching when filtering headers.

The core issue lies in the architectural mismatch: these filter strategies use case-sensitive String.startsWith('Camel') or String.startsWith('camel') checks, while the underlying Camel Exchange stores headers in a case-insensitive map. When a header like CAmelExecCommandExecutable passes through the filter (because it doesn't match the case-sensitive check), it gets stored in the Exchange and is later resolved by downstream components such as camel-exec using case-insensitive lookup, treating it as the canonical CamelExecCommandExecutable header.

Root Cause

The root cause is CWE-178: Improper Handling of Case Sensitivity. The incomplete propagation of the setLowerCase(true) fix across all header filter strategy implementations created a security gap. While HTTP-based routes were protected after the CVE-2025-27636 fix, non-HTTP message transports remained vulnerable because their filter strategies maintained case-sensitive behavior that conflicted with the case-insensitive header storage in Camel Exchange.

Attack Vector

The attack requires producer access to a message broker (JMS, CoAP, or Google Pub/Sub) that is consumed by a vulnerable Apache Camel route. An attacker crafts messages containing case-variant Camel internal headers that bypass the case-sensitive filter checks. When these messages reach downstream header-driven components like camel-exec or camel-file, the headers are resolved using case-insensitive lookup, allowing the attacker to control execution parameters.

For exploitation via camel-exec, an attacker can inject headers like CAmelExecCommandExecutable or cAMELExecCommandArgs to specify arbitrary commands and arguments. For camel-file, similar techniques can be used to control file paths and content, enabling arbitrary file write operations. The network-accessible attack vector with low complexity makes this particularly dangerous in environments where message broker access is not strictly controlled.

Detection Methods for CVE-2026-40453

Indicators of Compromise

• JMS or message queue traffic containing unusual case-variant Camel headers (e.g., CAmel*, cAMEL*, CAMEL*)
• Unexpected process execution originating from Camel application processes, particularly via the camel-exec component
• Suspicious file write operations in directories accessed by Camel routes
• Anomalous system commands being executed in the context of the application server running Apache Camel

Detection Strategies

• Implement deep packet inspection on message broker traffic to identify headers matching case-insensitive patterns for Camel* internal headers
• Deploy application-level logging to capture all incoming message headers before and after filter processing
• Monitor process creation events on systems running Apache Camel, alerting on child processes spawned by Java/Camel runtime
• Analyze message queue audit logs for messages containing multiple header variations targeting Camel internal namespaces

Monitoring Recommendations

• Enable verbose logging for camel-jms, camel-sjms, camel-coap, and camel-google-pubsub components to capture header processing details
• Configure SIEM rules to correlate JMS message ingestion events with subsequent command execution or file system modifications
• Establish baseline behavior for Camel route processing and alert on deviations, particularly unexpected exec or file operations
• Monitor for reconnaissance activity such as repeated message submissions with varying header casing patterns

How to Mitigate CVE-2026-40453

Immediate Actions Required

• Upgrade Apache Camel to version 4.20.0 immediately for production environments
• For organizations using the 4.14.x LTS stream, upgrade to version 4.14.6
• For organizations on the 4.18.x release stream, upgrade to version 4.18.2
• Audit all Camel routes that consume from JMS, CoAP, or Google Pub/Sub endpoints and forward to header-driven components like camel-exec or camel-file

Patch Information

Apache has released patched versions that apply the setLowerCase(true) fix consistently across all header filter strategy implementations. Users should upgrade to one of the following versions based on their deployment stream:

• Version 4.20.0: Primary recommended upgrade for all users
• Version 4.14.6: For users on the 4.14.x LTS release stream
• Version 4.18.2: For users on the 4.18.x release stream

Detailed patch information and upgrade instructions are available in the Apache Camel CVE-2026-40453 Advisory.

Workarounds

• Restrict producer access to message brokers consumed by Camel routes to trusted internal systems only
• Implement custom header filtering at the message broker level to reject messages containing any case-variant Camel headers before they reach Camel consumers
• Remove or disable routes that forward messages from JMS/CoAP/Pub/Sub endpoints to sensitive components like camel-exec and camel-file until patching is complete
• Deploy a custom Camel interceptor that normalizes all incoming header names to lowercase before route processing

# Configuration example - Restrict Camel exec component to specific commands
# In camel-context configuration, limit executable paths
# Note: This is a defense-in-depth measure, not a complete fix
export CAMEL_EXEC_ALLOWED_COMMANDS="/usr/bin/allowed-command1,/usr/bin/allowed-command2"
# Ensure message broker authentication is enabled
# For ActiveMQ example:
activemq.username=secure_user
activemq.password=strong_password_here
# Enable SSL/TLS for broker connections
activemq.broker.ssl.enabled=true