CVE-2026-48205: Apache Camel DNS Component SSRF Flaw

CVE-2026-48205 Overview

CVE-2026-48205 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel DNS component. The camel-dns producer reads DNS operation parameters from Exchange message headers whose constant values (dns.server, dns.name, dns.domain, dns.type, dns.class, term) do not begin with the Camel/camel prefix. Because HttpHeaderFilterStrategy blocks only the Camel header namespace at the HTTP boundary, attacker-supplied headers flow directly from an inbound HTTP request into the DNS producer. Any HTTP client can then redirect DNS queries to an attacker-controlled resolver or enumerate internal hostnames.

Critical Impact
Unauthenticated remote attackers can hijack DNS resolution to an attacker-controlled server and enumerate internal hostnames without credentials when a route bridges an unauthenticated HTTP consumer into a dns: producer.

Affected Products

Apache Camel 4.0.0 before 4.14.8
Apache Camel 4.15.0 before 4.18.3
Apache Camel 4.19.0 before 4.21.0

Discovery Timeline

2026-07-06 - CVE-2026-48205 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-48205

Vulnerability Analysis

Apache Camel is an integration framework that routes messages between components using an Exchange abstraction. The camel-dns component provides producers that perform DNS lookups. These producers read operation parameters from Exchange headers defined in DnsConstants, including DNS_SERVER, DNS_NAME, DNS_DOMAIN, DNS_TYPE, DNS_CLASS, and TERM.

The constants map to header names dns.server, dns.name, dns.domain, dns.type, dns.class, and term. Camel enforces a header namespace boundary at HTTP consumers through HttpHeaderFilterStrategy. This strategy filters only headers that start with the Camel/camel prefix. The dns.* and term headers bypass this filter and pass unchanged from HTTP request headers into the Exchange.

Root Cause

The root cause is improper input validation [CWE-20] combined with an inconsistent header naming convention. The DNS component defined header constants outside the protected Camel namespace, so the HTTP boundary filter does not strip them. Trust in header values from an untrusted HTTP consumer is treated as equivalent to trust in values set by route developers.

Attack Vector

An attacker sends an HTTP request to a route that bridges an HTTP consumer such as platform-http into a dns: producer. The attacker sets the dns.server header to the IP address of a resolver they control. The dig producer builds a SimpleResolver pointing at that server, executes the query, and returns the attacker-supplied response into the route. The attacker observes every queried name and can return poisoned records. By varying dns.name and dns.domain, the attacker resolves arbitrary internal hostnames and learns whether they exist, enabling internal network reconnaissance. No credentials are required when the bridging consumer is unauthenticated.

See the Apache Camel CVE-2026-48205 Advisory for vendor technical details.

Detection Methods for CVE-2026-48205

Indicators of Compromise

Inbound HTTP requests containing dns.server, dns.name, dns.domain, dns.type, dns.class, or term headers reaching Camel endpoints.
Outbound DNS queries from application hosts to resolvers outside the approved list of internal or corporate DNS servers.
Unusual DNS query patterns enumerating sequential or dictionary-based internal hostnames.

Detection Strategies

Inspect HTTP access logs and application logs for request headers matching the dns.* or term names on any Camel route endpoint.
Correlate application host egress to UDP/TCP port 53 against an allowlist of approved DNS resolvers and alert on deviations.
Review Camel route definitions to identify routes that connect an HTTP consumer directly to a dns: producer without header sanitization.

Monitoring Recommendations

Enable DNS query logging on application hosts and forward to a central analytics platform for baselining.
Track Apache Camel version inventory across build artifacts and running containers to identify vulnerable deployments.
Alert on any egress DNS traffic from application segments to arbitrary external IP addresses.

How to Mitigate CVE-2026-48205

Immediate Actions Required

Upgrade Apache Camel to version 4.21.0, 4.18.3, or 4.14.8 depending on the release stream in use.
Audit all Camel routes that pair an HTTP consumer with a dns: producer and treat any inbound header on those routes as untrusted.
Rewrite route definitions that use the raw header names to use CamelDnsServer, CamelDnsName, CamelDnsDomain, CamelDnsType, CamelDnsClass, and CamelDnsTerm after upgrading.

Patch Information

The Apache Camel project fixed the issue in versions 4.21.0, 4.18.3, and 4.14.8. The fix renames the DNS header constants into the Camel namespace so that HttpHeaderFilterStrategy strips them at the HTTP boundary. Refer to the Apache Camel CVE-2026-48205 Advisory and the OpenWall OSS Security Mailing List Post for full remediation guidance.

Workarounds

Strip dns.server, dns.name, dns.domain, dns.type, dns.class, and term headers from any untrusted ingress before the message reaches the dns: producer.
Set DNS server and lookup parameters explicitly from a trusted source inside the route rather than reading them from inbound headers.
Place authentication in front of any HTTP consumer that bridges to a dns: producer to remove the unauthenticated attack path.

bash

# Example Camel route header sanitization before dns: producer
from("platform-http:/lookup")
    .removeHeaders("dns.*")
    .removeHeader("term")
    .setHeader("CamelDnsServer", constant("10.0.0.53"))
    .setHeader("CamelDnsName", header("queryName"))
    .to("dns:dig");