CVE-2026-49098: Apache Camel Kafka Component RCE Flaw

CVE-2026-49098 Overview

CVE-2026-49098 is a header injection vulnerability in the Apache Camel Kafka Component. The camel-kafka producer honors the kafka.OVERRIDE_TOPIC Exchange header at runtime, allowing that header to override the topic configured on the endpoint. Because the control headers use plain, non-Camel-prefixed names, upstream filter strategies such as HttpHeaderFilterStrategy do not strip them. In a route that bridges an HTTP consumer into a Kafka producer, any remote HTTP client can inject kafka.* headers and redirect messages to arbitrary Kafka topics. The flaw is tracked under [CWE-20] Improper Input Validation and affects Apache Camel versions 4.0.0 through 4.20.x prior to the fixed releases.

Critical Impact
Unauthenticated remote attackers can redirect Kafka messages to arbitrary topics, backdate records, or target specific partitions by injecting kafka.* headers through an upstream HTTP consumer.

Affected Products

Apache Camel 4.0.0 through 4.14.7
Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x (fixed in 4.21.0)

Discovery Timeline

2026-07-06 - CVE-2026-49098 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49098

Vulnerability Analysis

The Apache Camel Kafka producer supports runtime overrides of the target topic through Exchange headers. The KafkaProducer.evaluateTopic() method returns the value of the kafka.OVERRIDE_TOPIC header in preference to the topic configured on the endpoint. Related control headers include kafka.OVERRIDE_TIMESTAMP and kafka.PARTITION_KEY.

Camel provides KafkaHeaderFilterStrategy to filter the kafka.* namespace, but this filter only applies at the Kafka-to-Exchange serialization boundary. It does not filter headers that arrive from upstream components in a multi-component route. When an HTTP consumer such as platform-http bridges into a kafka: producer, HttpHeaderFilterStrategy blocks only the Camel/camel namespace, so any kafka.* header flows through untouched.

An attacker sending an HTTP request with a kafka.OVERRIDE_TOPIC header causes the producer to publish to an attacker-chosen topic. This enables writes to sensitive internal topics or injection of crafted messages into topics consumed by critical downstream services.

Root Cause

The control-header constants in KafkaConstants use plain, non-Camel-prefixed names such as kafka.OVERRIDE_TOPIC, kafka.OVERRIDE_TIMESTAMP, and kafka.PARTITION_KEY. Upstream header filter strategies scope their blocklists to the Camel* prefix and therefore do not remove these values. The producer trusts any inbound header with these names as if it originated from a trusted internal source.

Attack Vector

Exploitation requires a Camel route that ingests untrusted input through an upstream consumer such as platform-http, jetty, or netty-http and forwards it to a kafka: producer. The attacker sends an HTTP request that includes a kafka.OVERRIDE_TOPIC header set to an arbitrary topic name. No authentication is required when the bridging consumer is unauthenticated. The vulnerability manifests as CWE-20 improper input validation and produces a confidentiality impact by redirecting messages to unintended topics.

Detection Methods for CVE-2026-49098

Indicators of Compromise

HTTP requests containing headers named kafka.OVERRIDE_TOPIC, kafka.OVERRIDE_TIMESTAMP, or kafka.PARTITION_KEY reaching Camel HTTP endpoints.
Kafka producer logs showing writes to topics not declared in the Camel route configuration.
Kafka records with timestamps that predate the route's deployment or fall outside expected time windows.

Detection Strategies

Enable request logging on Camel HTTP consumers and alert on any inbound header matching the kafka.* pattern.
Correlate Camel producer metrics with the topic allow-list defined in application configuration; flag divergences.
Audit Camel routes for combinations of HTTP-family consumers feeding directly into kafka: producers without header sanitization.

Monitoring Recommendations

Ingest Kafka broker audit logs and Camel application logs into a centralized analytics platform to correlate produce operations against expected topic patterns.
Track partition-key distribution to detect skew that may indicate kafka.PARTITION_KEY manipulation.
Alert on Kafka records whose timestamp field materially deviates from broker ingestion time.

How to Mitigate CVE-2026-49098

Immediate Actions Required

Inventory all Camel deployments and identify routes that connect HTTP consumers to kafka: producers.
Upgrade to a fixed release: 4.21.0 on the main line, 4.14.8 on the 4.14 LTS stream, or 4.18.3 on the 4.18 stream.
For routes that set or read Kafka headers by raw name, migrate to the new CamelKafka* constants such as CamelKafkaOverrideTopic and CamelKafkaTopic.
Restrict network access to Camel HTTP endpoints that bridge into Kafka producers and require authentication where feasible.

Patch Information

Apache Camel has released fixed versions 4.21.0, 4.18.3, and 4.14.8. The fix renames the control-header constants to use the CamelKafka* prefix so that existing Camel* header filter strategies remove them automatically. Details are published in the Apache Camel CVE-2026-49098 Advisory and the OpenWall OSS Security Post.

Workarounds

Strip kafka.* headers from any untrusted ingress before the kafka: producer, for example removeHeaders("kafka.*") at the start of the route.
Set the target topic explicitly from a trusted source inside the route rather than allowing endpoint defaults to be overridden.
Deploy an API gateway or reverse proxy in front of Camel HTTP consumers to drop request headers matching the kafka.* pattern.

bash

# Camel route mitigation example (Java DSL)
from("platform-http:/ingest")
    .removeHeaders("kafka.*")
    .setHeader("CamelKafkaTopic", constant("trusted-topic"))
    .to("kafka:trusted-topic?brokers=broker:9092");