CVE-2026-48203: Apache Camel SSRF Vulnerability

CVE-2026-48203 Overview

CVE-2026-48203 is a header injection and Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel Solr component. The camel-solr producer forwards Exchange message headers prefixed with SolrParam. and SolrField. into Solr requests and indexed documents. Because these prefixes do not begin with Camel/camel, the HttpHeaderFilterStrategy fails to strip them at the HTTP boundary. Attackers can inject arbitrary Solr parameters such as shards, stream.url, or qt through crafted HTTP headers, forcing the Solr backend to issue requests to attacker-chosen URLs or reach administrative handlers. No authentication is required when the bridging HTTP consumer is unauthenticated.

Critical Impact
Unauthenticated attackers can trigger SSRF against internal services or cloud metadata endpoints, tamper with indexed documents, and access administrative Solr request handlers.

Affected Products

Apache Camel 4.0.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x

Discovery Timeline

2026-07-06 - CVE-2026-48203 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-48203

Vulnerability Analysis

The flaw resides in the camel-solr producer's header-to-parameter mapping. Apache Camel defines SolrConstants.HEADER_PARAM_PREFIX and HEADER_FIELD_PREFIX as the literal strings SolrParam. and SolrField.. The producer copies any Exchange header matching these prefixes into either Solr request parameters or fields of the indexed document.

In routes that bridge an HTTP consumer such as platform-http to a solr: producer, inbound HTTP headers become Exchange headers. The HttpHeaderFilterStrategy blocks only headers within the Camel/camel namespace, so SolrParam.* and SolrField.* headers pass through unfiltered. Attackers control Solr request parameters directly through HTTP request headers [CWE-20].

Root Cause

The prefix constants were defined without the Camel namespace guard that the header filter strategy relies on. This misalignment between the producer's header contract and the HTTP filter allows untrusted client input to reach a security-sensitive downstream component without neutralization.

Attack Vector

An attacker sends an HTTP request to a Camel route that terminates in a solr: producer. By setting a header such as SolrParam.shards or SolrParam.stream.url, the attacker forces the Solr server to issue outbound HTTP requests to arbitrary URLs, enabling SSRF against internal services or cloud metadata endpoints. Setting SolrParam.qt reaches administrative request handlers. SolrField.* headers inject arbitrary fields into indexed documents, corrupting the search index.

The vulnerability is exploited through crafted HTTP headers on any route bridging an unauthenticated HTTP consumer into the Solr producer. Refer to the Apache Camel CVE-2026-48203 Advisory for the vendor description.

Detection Methods for CVE-2026-48203

Indicators of Compromise

Inbound HTTP requests containing headers with the SolrParam. or SolrField. prefix from untrusted clients.
Outbound connections from Solr servers to unexpected internal IP ranges, metadata endpoints such as 169.254.169.254, or attacker-controlled domains.
Solr access logs showing shards, stream.url, or qt parameters originating from user-facing routes.
Unexpected fields appearing in indexed Solr documents that do not match the route's schema.

Detection Strategies

Inspect HTTP ingress logs and web application firewall telemetry for request headers matching the SolrParam.* or SolrField.* patterns.
Correlate HTTP requests to Camel routes with outbound Solr network activity to identify SSRF chains.
Audit deployed Camel route definitions for platform-http or other HTTP consumers piped into solr: producers without explicit header filtering.

Monitoring Recommendations

Enable verbose logging on Solr request handlers and alert on invocations of administrative handlers from application routes.
Monitor egress traffic from Solr hosts and block connections to cloud metadata IPs and internal management networks.
Track Camel version inventory to prioritize vulnerable deployments running 4.0.0-4.14.7, 4.15.0-4.18.2, or 4.19.0-4.20.x.

How to Mitigate CVE-2026-48203

Immediate Actions Required

Upgrade Apache Camel to version 4.21.0, or apply the LTS fix in 4.14.8, or the 4.18.x stream fix in 4.18.3.
Update route definitions that set Solr parameters via raw prefixes to use CamelSolrParam. and CamelSolrField. instead of SolrParam. and SolrField..
Audit all Camel routes that bridge HTTP consumers into solr: producers and enumerate exposure.

Patch Information

Apache has released fixes in Camel 4.14.8, 4.18.3, and 4.21.0. The patched releases rename the header prefix constants to CamelSolrParam. and CamelSolrField., bringing them within the Camel namespace that HttpHeaderFilterStrategy filters at the HTTP boundary. See the Apache Camel CVE-2026-48203 Advisory and the Openwall OSS-Security mailing list update for release details.

Workarounds

Strip any SolrParam.* and SolrField.* headers from untrusted ingress before the solr: producer in the route.
Set required Solr parameters and fields explicitly from a trusted source inside the route, not from client-controlled headers.
Place authentication in front of any HTTP consumer that bridges into a Solr producer.
Restrict egress from Solr hosts to prevent SSRF against internal services and cloud metadata endpoints.

bash

# Configuration example: remove untrusted Solr headers before the producer
# In a Camel route (Java DSL)
from("platform-http:/search")
    .removeHeaders("SolrParam.*")
    .removeHeaders("SolrField.*")
    .setHeader("CamelSolrParam.q", simple("${body}"))
    .to("solr:http://solr.internal:8983/solr/collection1");