Apache Camel Template Injection via HTTP Producer Headers

Apache Camel components (Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP) contain a critical vulnerability, CVE-2026-78164, involving improper neutralization of template engine elements. The Camel HTTP producer families incorrectly process inbound headers CamelHttpUri and CamelRestHttpUri by passing them through CamelContext.resolvePropertyPlaceholders().

This resolution mechanism is intended for configuration and is not a secure URI-parsing step. It grants attackers access to OS environment variables, JVM system properties, cloud secret stores (AWS, Azure, GCP, HashiCorp, IBM, CyberArk, and Kubernetes), and the ability to invoke no-argument methods on any bean registered within the application context. Attackers can trigger this via direct header injection or, in certain reverse-proxy configurations, by manipulating the request line. The vulnerability allows for information disclosure of sensitive configuration data and potential remote code execution through secondary exploitation of reachable beans. This issue impacts Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0.

Impact

Successful exploitation leads to the exposure of sensitive secrets, environment configuration, and potential unauthorized code execution via bean invocation. This impacts any organization running Apache Camel HTTP components exposed to untrusted input, particularly in cloud-native environments where secret stores are integrated directly into the Camel context.

Recommendation

Prioritized actions for security teams:

• Patch immediately: Upgrade to Apache Camel 4.23.0, 4.22.1, or 4.18.5 as per the affected version stream.
• Mitigation (short-term): For deployments unable to patch, implement a HeaderFilterStrategy to strip CamelHttpUri and CamelRestHttpUri headers at the trust boundary before they reach the producer.
• Mitigation (short-term): Enable skipControlHeaders=true on camel-http endpoints where applicable, though this is not available for all affected components.
• Configuration: Avoid storing secrets in environment variables or system properties that are resolvable via Camel placeholders; migrate secrets to a dedicated, restricted-access vault service.