CVE-2026-63621: Apache Camel Knative Component SSRF Vulnerability

CVE-2026-63621 Overview

CVE-2026-63621 is an improper input validation and injection vulnerability [CWE-20] in the Apache Camel Knative component. The camel-knative consumer maps inbound CloudEvent attributes onto Camel message headers. In structured content mode (Content-Type: application/cloudevents+json), extension fields from the JSON body are copied into Exchange headers without applying KnativeHttpHeaderFilterStrategy. An unauthenticated remote attacker can inject Camel-internal headers such as CamelHttpUri, CamelHttpPath, and CamelFileName. When routes forward messages to header-driven components like camel-http or camel-file, the injected headers override configured values.

Critical Impact
Unauthenticated attackers can trigger server-side request forgery (SSRF), path traversal, or message-dispatch redirection through structured-mode CloudEvent requests to affected Camel Knative consumers.

Affected Products

Apache Camel 3.15.0 through 4.14.8
Apache Camel 4.15.0 through 4.18.3
Apache Camel 4.19.0 through 4.21.0

Discovery Timeline

2026-08-24 - CVE-2026-63621 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-63621

Vulnerability Analysis

The Apache Camel Knative component provides two content modes for consuming CloudEvents. Binary content mode transmits CloudEvent attributes as HTTP headers, while structured content mode transmits them as JSON fields inside the request body. The binary path correctly routes headers through KnativeHttpHeaderFilterStrategy, which blocks Camel-internal control headers from entering the Exchange.

The structured content path bypasses this filter entirely. The CloudEventProcessors implementation for spec versions 1.0, 1.0.1, and 1.0.2 reads extension fields directly from the JSON payload and copies each key into the Exchange header map. Camel matches header names case-insensitively, so an attacker can supply keys like camelhttpuri or CamelFilename to reach internal routing logic.

This flaw is an incomplete fix of prior header-filter hardening. Related patterns were addressed in CVE-2026-47323 (camel-cxf/camel-knative), CVE-2025-30177 (camel-undertow), CVE-2025-27636 and CVE-2025-29891 (broader inbound header filtering), and CVE-2026-40453 (non-HTTP strategies).

Root Cause

The root cause is missing application of HeaderFilterStrategy on the structured-mode ingestion path. Camel-internal headers share the same namespace as user-supplied CloudEvent extensions and are matched case-insensitively, so untrusted extension keys can shadow trusted routing configuration.

Attack Vector

An unauthenticated attacker sends an HTTP POST with Content-Type: application/cloudevents+json to a Camel Knative consumer endpoint. The JSON body includes CloudEvent extension keys named after Camel-internal headers. When the route forwards the Exchange to camel-http, the injected CamelHttpUri header redirects the outbound request to an attacker-controlled destination, producing SSRF. Routes forwarding to camel-file are vulnerable to path traversal through injected CamelFileName values.

Refer to the Apache Camel CVE-2026-63621 Advisory for the vendor's technical description.

Detection Methods for CVE-2026-63621

Indicators of Compromise

Inbound HTTP requests to Knative consumer endpoints with Content-Type: application/cloudevents+json containing JSON keys that match Camel-internal header names such as camelhttpuri, camelhttppath, or camelfilename (case-insensitive).
Outbound HTTP requests from Camel workers to unexpected internal or external hosts shortly after CloudEvent ingestion.
File writes from camel-file producers with paths containing traversal sequences (../) or unexpected absolute paths.

Detection Strategies

Inspect application and reverse-proxy logs for CloudEvent requests whose JSON bodies contain keys prefixed with camel under case-insensitive matching.
Correlate Knative consumer events with subsequent outbound network connections initiated by the Camel process, flagging destinations outside expected allowlists.
Deploy a request-body parser at the ingress or WAF layer to reject CloudEvent extensions that collide with the reserved Camel header namespace.

Monitoring Recommendations

Enable verbose logging on org.apache.camel.component.knative and audit Exchange headers on the consumer boundary.
Alert on egress connections from Camel workloads to non-allowlisted destinations, particularly link-local ranges (169.254.0.0/16) that indicate cloud metadata SSRF attempts.
Track file creation events for camel-file producer directories and alert on paths outside the configured base directory.

How to Mitigate CVE-2026-63621

Immediate Actions Required

Upgrade Apache Camel to version 4.22.0, the primary fixed release.
Users on the 4.18.x LTS stream should upgrade to 4.18.4.
Users on the 4.14.x LTS stream should upgrade to 4.14.9.
Non-LTS versions 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 do not receive maintenance fixes; migrate to 4.18.4 or 4.22.0.

Patch Information

The fix extends KnativeHttpHeaderFilterStrategy enforcement to the structured content-mode path in CloudEventProcessors. Extension keys that collide with Camel-internal header names are now filtered before entering the Exchange. Full details are available in the Apache Camel CVE-2026-63621 Advisory.

Workarounds

Restrict inbound access to Knative consumer endpoints so that only trusted upstream services can publish CloudEvents.
Add a custom HeaderFilterStrategy at the route level that removes any headers matching the Camel* prefix immediately after the Knative consumer.
Configure camel-http producers with fixed endpoints and disable header-based endpoint overrides; configure camel-file producers with strict fileName expressions that do not consume attacker-controlled headers.

bash

# Maven coordinate update to remediate CVE-2026-63621
# Update your project's Camel BOM to a fixed release
mvn versions:set-property -Dproperty=camel.version -DnewVersion=4.22.0
mvn -U dependency:resolve