CVE-2026-49086: Apache Camel Auth Bypass Vulnerability

CVE-2026-49086 Overview

CVE-2026-49086 is an improper input validation vulnerability [CWE-20] in the Apache Camel DAPR component. The flaw exists in the DaprPubSubConsumer, which copies attacker-controllable CloudEvent fields into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These headers are treated as producer-direction routing hints, allowing an attacker who can publish to a subscribed topic to redirect republished messages to arbitrary Dapr Pub/Sub components and topics. This creates a Confused Deputy condition that bypasses route configuration and topic-level access controls in the underlying broker.

Critical Impact
An actor able to publish to the subscribed topic can redirect or exfiltrate republished messages to arbitrary Dapr Pub/Sub destinations without authentication or user interaction.

Affected Products

Apache Camel 4.12.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x (fixed in 4.21.0)

Discovery Timeline

2026-07-06 - CVE-2026-49086 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49086

Vulnerability Analysis

The camel-dapr component integrates Apache Camel routes with the Dapr Pub/Sub building block. When a message arrives, DaprPubSubConsumer reads two fields from the inbound CloudEvent — the Pub/Sub component name and the topic — and copies them into the Exchange as CamelDaprPubSubName and CamelDaprTopic headers.

These headers carry producer-direction semantics. When the same Exchange later reaches a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers their values over the destination configured on the producer endpoint. A route such as from('dapr-pubsub:p:t').to('dapr-pubsub:p:other') therefore delegates its destination decision to fields controlled by the message publisher.

Root Cause

The root cause is a trust boundary violation. The consumer treats attacker-controlled CloudEvent metadata as if it were trusted internal routing configuration. Because the producer proxy prefers header values over endpoint configuration, control flow is handed to the message author. This is a classic Confused Deputy pattern in which the framework acts with its own privileges but on data supplied by an untrusted principal.

Attack Vector

An attacker requires only the ability to publish a message to the topic the Camel route subscribes to. No authentication to Camel, Dapr, or the downstream broker is required beyond publish access to the subscribed topic. The attacker crafts a CloudEvent whose pubsubname and topic fields point at an arbitrary Dapr Pub/Sub component and topic. When the route republishes, the message is delivered to the attacker-chosen destination instead of the configured one, bypassing route logic and broker-level topic access controls.

See the Apache Camel CVE-2026-49086 Advisory for vendor technical details.

Detection Methods for CVE-2026-49086

Indicators of Compromise

Dapr Pub/Sub messages arriving on topics or components that are not referenced by any configured Camel producer endpoint.
CloudEvents on subscribed topics carrying pubsubname or topic metadata that differ from the subscribing route's configuration.
Unexpected outbound traffic from Camel workers to Dapr sidecars targeting components outside the application's routing manifest.

Detection Strategies

Inspect Camel Exchange logs for CamelDaprPubSubName and CamelDaprTopic header values that do not match the producing endpoint's configured destination.
Correlate Dapr sidecar publish logs with the application's expected route topology and flag deliveries to unlisted components or topics.
Enable Camel route tracing on dapr-pubsub endpoints in non-production environments to identify header-driven destination overrides.

Monitoring Recommendations

Alert on new or rare (pubsubname, topic) pairs observed at the Dapr sidecar publish API from Camel workloads.
Monitor broker-side authorization denials that could indicate probing for reachable topics via header injection.
Track Apache Camel dependency versions across build pipelines and flag any component in the vulnerable ranges.

How to Mitigate CVE-2026-49086

Immediate Actions Required

Upgrade Apache Camel to 4.21.0, or to 4.14.8 on the 4.14.x LTS stream, or to 4.18.3 on the 4.18.x stream.
Audit all routes using camel-dapr that consume from one Pub/Sub topic and republish to another.
Restrict publish permissions on subscribed Dapr Pub/Sub topics to trusted producers only.

Patch Information

The fix is available in Apache Camel 4.21.0, 4.18.3, and 4.14.8. Refer to the Apache Camel CVE-2026-49086 Advisory and the OpenWall OSS-Security discussion for the official remediation notice.

Workarounds

For deployments that cannot upgrade immediately, strip the producer-routing headers between the Dapr consumer and any downstream Dapr producer using removeHeaders('CamelDaprPubSubName', 'CamelDaprTopic').
Enforce broker-level access controls so that only trusted identities can publish to any topic consumed by a Camel dapr-pubsub route.
Segment Dapr Pub/Sub components so that a compromised route cannot reach sensitive components even if header injection succeeds.

bash

# Camel route mitigation: remove attacker-controllable routing headers
# between the Dapr consumer and any Dapr producer in the route
from("dapr-pubsub:p:t")
    .removeHeaders("CamelDaprPubSubName", "CamelDaprTopic")
    .to("dapr-pubsub:p:other");