Apache Camel: Request forgery vulnerability in camel-platform-http (CVE-2026-85316)

CVE-2026-85316 is a request forgery vulnerability in the camel-platform-http component. The vulnerability is caused by an incorrect implementation of proxy mode identification, where the library evaluates if an endpoint is a proxy by checking if the configured path starts with the string "proxy" instead of requiring an exact match.

Endpoints with paths starting with "proxy" (e.g., "proxyStats", "proxy-health") are incorrectly forced into proxy mode. In this mode, the endpoint acts as a forwarding proxy that uses the client-provided "Host" header to determine its destination. This behavior exposes internal services or resources that the application server can reach.

Impact

Successful exploitation allows for request forgery, where an attacker can proxy requests through the vulnerable endpoint to reach internal network resources. The severity is mitigated by the need for the application to have existing routes with paths starting with "proxy" that were not intended to serve as proxies.

Recommendation

• Upgrade camel-platform-http to version 4.18.5, 4.22.1, or 4.23.0.
• Upgrade camel-quarkus-platform-http to version 3.40.0 or later.
• If upgrading is not immediately possible, identify all platform-http endpoints with paths starting with "proxy" that are not intended to act as proxies and rename these paths to avoid the prefix conflict.