CVE-2026-46726: Apache Camel Vertx WebSocket SSRF Flaw

CVE-2026-46726 Overview

CVE-2026-46726 is a Server-Side Request Forgery (SSRF) and information disclosure vulnerability in the camel-vertx-websocket component of Apache Camel. The consumer copies inbound WebSocket query and path parameters into the Camel Exchange header map without applying a HeaderFilterStrategy. An unauthenticated attacker can inject Camel control headers such as CamelHttpUri through query parameters. When the route bridges into an HTTP producer, the injected URI redirects server-side requests and triggers property placeholder resolution that discloses environment variables, application properties, and vault secrets.

Critical Impact
Unauthenticated remote attackers can force the server to issue HTTP requests to internal services or cloud metadata endpoints and exfiltrate resolved vault and environment secrets.

Affected Products

Apache Camel 4.0.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x (before 4.21.0)

Discovery Timeline

2026-07-06 - CVE-2026-46726 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-46726

Vulnerability Analysis

The flaw resides in VertxWebsocketConsumer.populateExchangeHeaders(). This method maps inbound WebSocket query and path parameters directly into the Camel Exchange header map. No HeaderFilterStrategy filters the reserved Camel header namespace on inbound traffic. A client can therefore set Camel-internal control headers by supplying them as query string parameters on the WebSocket connect request.

The most consequential injectable header is CamelHttpUri (Exchange.HTTP_URI). When the WebSocket consumer feeds a downstream HTTP producer, the producer honors this header as the target URI. The attacker-supplied URI overrides the route's configured destination, producing a classic SSRF primitive against internal services or cloud instance metadata endpoints.

The HTTP producer additionally resolves Camel property placeholders on the outbound URI. Placeholders such as environment-variable references, application properties, or vault references embedded in the injected value are resolved to their real values before the request is issued. The attacker receives the resolved secrets in the URI sent to their controlled destination.

Root Cause

The root cause is improper input validation [CWE-20] and a missing header filter on the inbound mapping path. The consumer does not distinguish between externally supplied parameters and reserved Camel control headers, allowing the Camel header namespace to be populated from untrusted network input.

Attack Vector

An attacker connects to an exposed vertx-websocket endpoint and supplies query parameters named CamelHttpUri (or any Camel* / camel* header) with a URI containing property placeholders such as ${env:AWS_SECRET_ACCESS_KEY}. If the route routes the message to an HTTP producer, the producer resolves the placeholder and issues the outbound request to the attacker-controlled host. When the WebSocket endpoint requires no authentication, the entire chain is reachable remotely without credentials.

No verified public proof-of-concept is available. See the Apache Camel CVE-2026-46726 Advisory for authoritative technical detail.

Detection Methods for CVE-2026-46726

Indicators of Compromise

Inbound WebSocket handshake requests containing query parameters that match Camel* or camel* header names, especially CamelHttpUri.
Outbound HTTP requests from Camel worker processes to unexpected destinations such as 169.254.169.254, internal RFC1918 hosts, or unrelated public domains.
Camel access or route logs showing Exchange.HTTP_URI values that differ from the statically configured producer endpoint.
Outbound URLs containing resolved secret material or values that resemble vault, environment, or application property outputs.

Detection Strategies

Inspect application logs for WebSocket query strings containing case-insensitive camel prefixes and alert on any match.
Correlate WebSocket consumer activity with subsequent HTTP producer egress to identify redirected destinations.
Deploy egress network policies that log any outbound HTTP request from Camel hosts to cloud metadata IPs or non-allowlisted domains.

Monitoring Recommendations

Enable Camel route tracing on vertx-websocket consumers in staging to baseline expected header keys.
Forward Camel and reverse-proxy access logs to a SIEM and build detections for header injection patterns.
Monitor DNS queries from Camel workloads for lookups to attacker-typical domains or dynamic DNS providers.

How to Mitigate CVE-2026-46726

Immediate Actions Required

Upgrade Apache Camel to 4.21.0, or to 4.14.8 on the 4.14 LTS stream, or to 4.18.3 on the 4.18 stream.
Enforce authentication on all vertx-websocket consumer endpoints exposed to untrusted networks.
Audit routes that bridge a WebSocket consumer into an HTTP producer and treat them as high risk until patched.
Restrict egress from Camel workloads with an allowlist that blocks cloud metadata endpoints and arbitrary internet destinations.

Patch Information

The fix applies a HeaderFilterStrategy to the affected consumers that filters the Camel header namespace case-insensitively on inbound mapping. Externally supplied Camel* and camel* headers are no longer copied into the Exchange. Fixed versions are 4.14.8, 4.18.3, and 4.21.0. See the Apache Camel CVE-2026-46726 Advisory and the Openwall OSS-Security Mailing List Post for release detail.

Workarounds

Strip Camel control headers at the start of every route consuming from vertx-websocket using removeHeaders('Camel*') and removeHeaders('camel*').
Require authentication on the WebSocket endpoint through a reverse proxy or Vert.x auth handler.
Avoid bridging an untrusted WebSocket consumer directly into an HTTP producer whose target URI can be driven from message headers.
Disable Camel property placeholder resolution on URIs derived from message data where feasible.

bash

# Camel route mitigation example (Java DSL)
from("vertx-websocket:0.0.0.0:8080/ws")
    .removeHeaders("Camel*")
    .removeHeaders("camel*")
    .to("http://internal-service/api");