CVE-2026-48204: Apache Camel Auth Bypass Vulnerability

CVE-2026-48204 Overview

CVE-2026-48204 is an improper input validation and improper access control flaw in the Apache Camel camel-mongodb-gridfs component. The producer selects its GridFS operation from the gridfs.operation Exchange header when no explicit operation parameter is configured on the endpoint. Because the control-header constants use plain gridfs.* names rather than the Camel/camel prefix, HttpHeaderFilterStrategy allows them to cross the HTTP boundary. An unauthenticated remote attacker bridging through a platform-http consumer can override the intended operation and inject MongoDB operators through gridfs.metadata.

Critical Impact
Remote attackers can convert file uploads into remove, listAll, or findOne operations, delete or enumerate bucket contents, and perform NoSQL operator injection without credentials.

Affected Products

Apache Camel 4.0.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x

Discovery Timeline

2026-07-06 - CVE-2026-48204 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-48204

Vulnerability Analysis

The camel-mongodb-gridfs producer determines which GridFS operation to execute by reading the gridfs.operation header from the current Camel Exchange. This lookup only happens when the endpoint URI omits an explicit operation parameter, which is the default configuration. The producer then interprets additional headers such as gridfs.objectid, gridfs.metadata, gridfs.chunksize, and gridfs.fileid to parameterize the chosen operation.

Camel routes commonly bridge inbound HTTP traffic into producer components. On that boundary, HttpHeaderFilterStrategy strips headers whose names begin with Camel or camel to prevent HTTP clients from manipulating internal routing state. The GridFS constants do not use that prefix, so they pass through unfiltered. As a result, arbitrary HTTP request headers flow directly into the Exchange consumed by the GridFS producer.

The vulnerability is tracked under CWE-20 Improper Input Validation.

Root Cause

The root cause is the mismatch between the header namespace used by GridFS control constants and the namespace enforced by Camel's HTTP header filter. Values defined as gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, and gridfs.fileid fall outside the Camel/camel prefix that HttpHeaderFilterStrategy blocks. Untrusted HTTP headers therefore reach the producer as trusted control data.

Attack Vector

An attacker sends an HTTP request to a route that terminates at a mongodb-gridfs: producer without an explicit operation. Setting gridfs.operation: remove combined with an attacker-controlled gridfs.objectid deletes a file. Setting gridfs.operation: listAll enumerates the bucket, and findOne reads content. A crafted gridfs.metadata header is parsed as a MongoDB document, enabling NoSQL operator injection against the underlying database.

The vulnerability manifests entirely through HTTP header manipulation and requires no authentication when the bridging consumer is exposed anonymously. Refer to the Apache Camel CVE-2026-48204 Advisory for technical details.

Detection Methods for CVE-2026-48204

Indicators of Compromise

HTTP requests carrying gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, or gridfs.fileid headers reaching Camel-fronted endpoints.
MongoDB audit entries showing unexpected remove, findOne, or listAll GridFS operations originating from application service accounts.
Application logs recording GridFS operations that do not match the route's intended function (for example, upload endpoints performing deletions).

Detection Strategies

Inspect reverse proxy and web application firewall logs for inbound requests containing any header matching the regular expression ^gridfs\. and correlate with backend Camel routes.
Enable MongoDB auditing on GridFS buckets and alert on operation type distributions that deviate from expected baselines for each application identity.
Review Camel route definitions for mongodb-gridfs: producers without an explicit operation URI parameter and flag them for accelerated patching.

Monitoring Recommendations

Add SIEM correlation rules linking anomalous gridfs.* header presence with subsequent MongoDB write or delete operations.
Track the volume of remove and listAll GridFS operations per service account and alert on statistical outliers.
Monitor MongoDB error logs for parse failures on metadata documents, which can indicate operator injection attempts.

How to Mitigate CVE-2026-48204

Immediate Actions Required

Upgrade Apache Camel to 4.21.0 on the mainline branch as the primary remediation.
Upgrade to 4.14.8 if running the 4.14.x LTS stream, or to 4.18.3 on the 4.18.x stream.
Inventory all Camel routes that terminate at a mongodb-gridfs: producer and confirm whether an explicit operation parameter is set.
Restrict network exposure of platform-http and other HTTP consumers that bridge into GridFS producers until patching is complete.

Patch Information

Fixed versions are Apache Camel 4.14.8, 4.18.3, and 4.21.0. After upgrading, routes that pass GridFS control data through headers must migrate from the raw gridfs.* names to the new prefixed constants: CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize, and CamelGridFsFileId. These prefixed names are covered by HttpHeaderFilterStrategy and cannot cross the HTTP boundary. See the Apache Camel CVE-2026-48204 Advisory for full guidance.

Workarounds

Set an explicit operation parameter on every mongodb-gridfs: endpoint so the producer ignores the gridfs.operation header entirely.
Add a removeHeaders processor before the GridFS producer that strips headers matching the pattern gridfs.* from any untrusted ingress path.
Enforce authentication and authorization on all HTTP consumers that bridge into GridFS routes to eliminate anonymous access.

bash

# Configuration example: explicit operation and header stripping in a Camel route
from("platform-http:/upload")
    .removeHeaders("gridfs.*")
    .to("mongodb-gridfs:myDb?database=files&bucket=uploads&operation=create");