CVE-2026-49097: Apache Camel IRC Injection Vulnerability

CVE-2026-49097 Overview

CVE-2026-49097 is an improper input validation and injection vulnerability in the Apache Camel IRC component. The camel-irc producer accepts control headers such as irc.sendTo, irc.target, irc.messageType, irc.user.*, irc.num, and irc.value that do not use the Camel prefix. As a result, HttpHeaderFilterStrategy allows these headers to pass from inbound HTTP requests directly into the Exchange. Attackers can redirect IRC messages to arbitrary channels or users by injecting the irc.sendTo header. The flaw affects Apache Camel 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x.

Critical Impact
Unauthenticated attackers can redirect IRC messages, exfiltrate content, and impersonate legitimate bots in routes that bridge HTTP consumers to IRC producers.

Affected Products

Apache Camel 4.0.0 before 4.14.8
Apache Camel 4.15.0 before 4.18.3
Apache Camel 4.19.0 before 4.21.0

Discovery Timeline

2026-07-06 - CVE-2026-49097 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49097

Vulnerability Analysis

The Apache Camel IRC component producer determines the destination of outgoing IRC messages using the irc.sendTo Exchange header, defined by the constant IrcConstants.IRC_SEND_TO. When present, this header overrides the channel list configured on the endpoint. The message is then delivered only to the destination specified in the header.

The vulnerability stems from the naming convention used for IRC control headers. Headers such as irc.sendTo, irc.target, irc.messageType, irc.user.*, irc.num, and irc.value do not begin with the Camel or camel prefix. Apache Camel's HttpHeaderFilterStrategy only blocks headers in the Camel namespace at the HTTP boundary, so these IRC headers pass unfiltered from inbound HTTP requests into the Exchange context.

Root Cause

The root cause is improper input validation combined with an incomplete header filter denylist [CWE-20]. The producer trusts application-level control headers received from untrusted transports. Because the header names sit outside the filtered Camel namespace, HTTP clients supply values that Camel then treats as internal routing directives.

Attack Vector

In a route that bridges an HTTP consumer such as platform-http into an irc: producer, any HTTP client can set the irc.sendTo header on a request. The Camel route accepts the header, and the IRC producer routes the outgoing message to the attacker-supplied channel or nickname. Attackers can exfiltrate message content to a controlled nickname, leak internal messages into public channels, or deliver messages that appear to originate from the bot. No credentials are required when the bridging HTTP consumer is unauthenticated.

The vulnerability is described in the Apache Camel Security Advisory and the OpenWall OSS-Security Discussion.

Detection Methods for CVE-2026-49097

Indicators of Compromise

HTTP requests containing headers matching the pattern irc.sendTo, irc.target, irc.messageType, irc.user.*, irc.num, or irc.value reaching Camel routes.
IRC messages delivered to channels or nicknames that are not part of the endpoint's configured channel list.
Unexpected joins, private messages, or bot activity in IRC logs correlated with inbound HTTP traffic.

Detection Strategies

Inspect Camel route definitions for HTTP-to-IRC bridges that do not sanitize inbound headers before the irc: producer.
Review reverse proxy and application logs for HTTP requests carrying irc.* headers from untrusted clients.
Correlate IRC server logs with HTTP access logs to identify messages sent to destinations outside the configured channel set.

Monitoring Recommendations

Enable header logging on ingress HTTP consumers that feed into IRC producers.
Alert on any header keys prefixed with irc. originating from external network zones.
Monitor Apache Camel version inventories and flag deployments running versions listed in the security advisory.

How to Mitigate CVE-2026-49097

Immediate Actions Required

Upgrade Apache Camel to version 4.21.0, 4.18.3, or 4.14.8 based on the release stream in use.
Audit all Camel routes that bridge HTTP consumers into irc: producers and require authentication on the HTTP ingress.
Update route code to use the new CamelIrc* header names, for example CamelIrcSendTo, after upgrading.

Patch Information

Apache has released fixed versions that rename IRC control headers to use the Camel-prefixed namespace. Users on the 4.14.x LTS stream should upgrade to 4.14.8. Users on 4.18.x should upgrade to 4.18.3. All other affected users should upgrade to 4.21.0. Details are provided in the Apache Camel Security Advisory.

Workarounds

Strip untrusted IRC headers at the start of the route using removeHeaders('irc.*') before the irc: producer.
Set the IRC destination exclusively from a trusted source such as a static endpoint configuration or a value derived from server-side logic.
Place the HTTP consumer behind an authenticating gateway that rejects requests carrying irc.* headers.

bash

# Configuration example - remove untrusted IRC headers before the producer
from("platform-http:/notify")
  .removeHeaders("irc.*")
  .setHeader("CamelIrcSendTo", constant("#trusted-channel"))
  .to("irc:bot@irc.example.org?channels=#trusted-channel");