CVE-2026-46453: Apache Camel Auth Bypass Vulnerability

CVE-2026-46453 Overview

CVE-2026-46453 is an improper input validation and authorization bypass vulnerability in the Apache Camel ElasticSearch Rest Client component. The camel-elasticsearch-rest-client component reads Exchange headers named SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, and ID to control its behavior. These header names lack the Camel prefix that the inbound HttpHeaderFilterStrategy uses to block untrusted inputs. When a Camel route exposes an HTTP entry point in front of an Elasticsearch producer, an unauthenticated attacker can inject these headers to override the configured query and operation.

Critical Impact
Unauthenticated remote attackers can read every document in an index, delete documents by ID, or exfiltrate selected fields by setting HTTP headers on requests to Camel routes fronting an Elasticsearch producer.

Affected Products

Apache Camel 4.3.0 before 4.14.8
Apache Camel 4.15.0 before 4.18.3
Apache Camel 4.19.0 before 4.21.0

Discovery Timeline

2026-07-06 - CVE-2026-46453 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-46453

Vulnerability Analysis

The flaw involves two classified weaknesses: Improper Input Validation [CWE-20] and Authorization Bypass Through User-Controlled Key [CWE-639]. Attackers exploit the vulnerability over the network with low complexity and no authentication, but the impact is limited to information disclosure and unauthorized data manipulation within reachable Elasticsearch indices.

Apache Camel components typically prefix their Exchange header constants with Camel (for example CamelSqlQuery, CamelMongoDbCriteria, CamelCqlQuery). Camel's inbound HttpHeaderFilterStrategy uses this prefix to strip potentially dangerous headers arriving from untrusted HTTP clients. The ElasticSearchRestClientConstant class breaks this convention by defining unprefixed string values, allowing the headers to reach the producer unchanged.

Root Cause

The root cause is a naming inconsistency in the ElasticSearchRestClientConstant class. The Java field names appear normal, but the underlying string values assigned to headers omit the Camel prefix. Because HttpHeaderFilterStrategy filters only headers whose names begin with Camel or camel, the Elasticsearch control headers bypass inbound filtering and reach the producer with attacker-controlled values.

Attack Vector

An attacker sends an HTTP request to any Camel route that exposes an HTTP endpoint (for example platform-http) in front of an elasticsearch-rest-client producer. By setting headers such as SEARCH_QUERY with a match_all query body, OPERATION set to Delete combined with an ID, or INDEX_NAME targeting a different index, the attacker overrides the route author's configuration. The producer executes the injected operation unconditionally and without credential checks.

No verified exploit code is publicly available. Refer to the Apache Camel CVE-2026-46453 Advisory for authoritative technical details.

Detection Methods for CVE-2026-46453

Indicators of Compromise

Inbound HTTP requests containing headers named SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, or ID reaching Camel-fronted services.
Unexpected Elasticsearch Delete or DeleteIndex operations originating from application service accounts used by Camel routes.
Elasticsearch query logs showing match_all searches against sensitive indices at times inconsistent with normal application behavior.
Spikes in outbound data volume from Elasticsearch nodes correlated with HTTP requests to Camel endpoints.

Detection Strategies

Inspect HTTP access logs at reverse proxies and load balancers for the five affected header names on any route that reaches a Camel deployment.
Correlate Elasticsearch audit logs with Camel route request logs to identify operations that do not match the route's declared behavior.
Deploy web application firewall rules that flag or block requests containing the unprefixed header names on Camel-fronted endpoints.

Monitoring Recommendations

Enable Elasticsearch audit logging and forward events to a SIEM for correlation with upstream HTTP traffic.
Baseline the operations each Camel route performs against Elasticsearch and alert on deviations such as unexpected index names or delete operations.
Monitor for version drift on apache-camel artifacts across build pipelines and running services to identify unpatched deployments.

How to Mitigate CVE-2026-46453

Immediate Actions Required

Upgrade Apache Camel to version 4.21.0, or to the LTS fix release 4.14.8, or to 4.18.3 on the 4.18.x stream.
Inventory all Camel routes that use camel-elasticsearch-rest-client and identify any that sit behind HTTP entry points such as platform-http, jetty, netty-http, or servlet.
Restrict network access to Camel HTTP endpoints so that only trusted clients can reach routes that produce to Elasticsearch.

Patch Information

The fix renames the Exchange header constant string values to carry the Camel prefix: CamelElasticsearchId, CamelElasticsearchSearchQuery, CamelElasticsearchIndexSettings, CamelElasticsearchIndexName, and CamelElasticsearchOperation. The Java field names remain unchanged, preserving source compatibility. The renamed strings match the HttpHeaderFilterStrategy prefix rule and are blocked from untrusted inbound HTTP traffic. See the Apache Camel CVE-2026-46453 Advisory for the complete list of fixed versions.

Workarounds

Add removeHeader('SEARCH_QUERY'), removeHeader('OPERATION'), removeHeader('INDEX_NAME'), removeHeader('INDEX_SETTINGS'), and removeHeader('ID') processors in front of every elasticsearch-rest-client endpoint.
Apply a custom HeaderFilterStrategy on inbound HTTP components that explicitly blocks the five affected header names.
Place an API gateway or reverse proxy in front of Camel routes to strip the affected headers before requests reach the Java Virtual Machine (JVM).

bash

# Configuration example - Camel route mitigation (Java DSL)
from("platform-http:/search")
    .removeHeader("SEARCH_QUERY")
    .removeHeader("OPERATION")
    .removeHeader("INDEX_NAME")
    .removeHeader("INDEX_SETTINGS")
    .removeHeader("ID")
    .to("elasticsearch-rest-client://myCluster?operation=Search&indexName=products");