CVE-2026-71300: Apache Camel Atmosphere WebSocket Auth Bypass

CVE-2026-71300 Overview

CVE-2026-71300 is an improper input validation vulnerability [CWE-20] in the Apache Camel camel-atmosphere-websocket component. The producer selects WebSocket recipients using Exchange headers whose string names sit outside the Camel namespace, including websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, and websocket.errorType. The HttpHeaderFilterStrategy inherited from ServletEndpoint only filters headers with the Camel or camel prefix, so these dotted names pass through HTTP consumers unchecked. An external attacker can inject these headers into a route that bridges HTTP into an atmosphere-websocket producer and hijack message dispatch.

Critical Impact
An unauthenticated remote attacker can supply an HTTP header to redirect WebSocket notifications intended for one client to another connected peer, breaking message confidentiality and integrity.

Affected Products

Apache Camel 4.0.0 before 4.14.9
Apache Camel 4.15.0 before 4.18.4
Apache Camel 4.19.0 before 4.22.0

Discovery Timeline

2026-08-24 - CVE-2026-71300 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-71300

Vulnerability Analysis

The camel-atmosphere-websocket producer routes messages to connected WebSocket peers based on Exchange headers. WebsocketEndpoint extends ServletEndpoint and inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes. The dispatch headers use dotted names such as websocket.connectionKey and websocket.connectionKey.list, which fall outside the filtered namespace. HTTP-family consumers admit these headers in both directions.

In a route bridging an HTTP consumer to an atmosphere-websocket producer, WebsocketProducer.process evaluates the list-valued header before the single-key header. An injected websocket.connectionKey.list value overrides the recipient selected by the route. The attacker can suppress a legitimate notification or redirect it to any connected peer whose connection key is known.

Root Cause

The header filter strategy applies namespace filtering only to Camel-prefixed keys, but the WebSocket dispatch constants were declared as literal dotted strings when introduced in Camel 2.17.0. The dispatch namespace therefore leaked across the HTTP trust boundary from initial release until this fix.

Attack Vector

The attacker sends an ordinary inbound HTTP request to a consumer that feeds an atmosphere-websocket producer. Camel's HTTP binding promotes a repeated header name or a bracketed value into a List when mapping onto the Exchange. A single crafted HTTP header is sufficient to reach the list-valued dispatch branch. No query parameter, authentication, or user interaction is required. This vector is distinct from CVE-2026-55993, which targets the consumer-side query-parameter path in the same component.

Code examples are not published for this issue. See the Apache Camel CVE-2026-71300 Advisory for technical details.

Detection Methods for CVE-2026-71300

Indicators of Compromise

Inbound HTTP requests containing headers named websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, or websocket.errorType.
Repeated or bracketed HTTP header values that Camel promotes into a List on the Exchange.
WebSocket clients receiving notifications addressed to a different connectionKey than their session.

Detection Strategies

Inspect HTTP access logs and reverse-proxy telemetry for request headers matching the websocket.* pattern.
Correlate atmosphere-websocket producer dispatch logs with the upstream HTTP consumer to detect recipient mismatches.
Audit Camel route definitions for HTTP consumers that feed atmosphere-websocket producers without header stripping.

Monitoring Recommendations

Enable header logging on HTTP consumers bridged into WebSocket producers at debug level during triage.
Alert on any occurrence of the dispatch header namespace at the perimeter or ingress controller.
Track deployed Apache Camel versions across services and flag any release below 4.14.9, 4.18.4, or 4.22.0.

How to Mitigate CVE-2026-71300

Immediate Actions Required

Upgrade Apache Camel to 4.22.0, 4.18.4, or 4.14.9 based on the release stream in use.
Strip dispatch headers at the trust boundary by placing removeHeaders("websocket.*") between the HTTP consumer and the atmosphere-websocket producer.
Audit routes that reference dispatch headers by literal string; the fix renames these into the Camel namespace and is a breaking change for such routes.

Patch Information

Apache has fixed the vulnerability in Camel 4.22.0, 4.18.4, and 4.14.9. The fix moves the header string values into the Camel namespace, which is filtered by HttpHeaderFilterStrategy. Routes that reference WebsocketConstants fields symbolically are unaffected. Consult the Apache Camel CVE-2026-71300 Advisory and the corresponding upgrade guides.

Workarounds

Insert removeHeaders("websocket.*") in every route that bridges an HTTP consumer into an atmosphere-websocket producer.
Do not bridge untrusted HTTP consumers directly into WebSocket producers whose dispatch is header-driven.
Terminate untrusted HTTP traffic behind a gateway that filters or renames headers matching the websocket.* prefix before they reach Camel.

bash

# Configuration example
# Apply header stripping between the HTTP consumer and the atmosphere-websocket producer
from("servlet:///notify")
    .removeHeaders("websocket.*")
    .to("atmosphere-websocket:///push");