Apache Camel: Saga processor header hijacking (CVE-2026-85312)

Apache Camel versions 4.x before 4.18.5 and 4.19.0 through 4.22.0 are vulnerable to a saga hijacking flaw identified as CVE-2026-85312. The vulnerability resides in the SagaProcessor component, which improperly trusts the Long-Running-Action message header when determining the current saga coordinator. Because this header lacks a 'Camel' prefix, it is not stripped by standard consumer header filters, allowing an external sender to inject the header into inbound messages.

By supplying a specific identifier in the Long-Running-Action header, an attacker can influence which saga an exchange joins. This allows the attacker to associate their request with an existing long-running action initiated by another party or force the system to perform compensation actions incorrectly. This exposure is limited to deployments actively utilizing the Saga EIP. Apache has released patches in versions 4.18.5 and 4.22.1 to ensure the header is only consulted if the configured saga service explicitly supports the protocol.

Impact

Successful exploitation allows an unauthorized party to manipulate long-running transaction workflows within an Apache Camel application. This can result in unauthorized participation in sagas, misrouting of transactions, or the execution of compensation logic for actions the attacker did not initiate. The impact is significant for financial or enterprise integration workflows where saga consistency and transaction integrity are required.

Recommendation

1. Upgrade all Apache Camel installations to version 4.18.5, 4.22.1, or 4.23.0 to incorporate the fix for CVE-2026-85312.
2. For environments running Camel Quarkus, upgrade to version 3.40.0 or later to receive the patched Camel 4.22.1 core.
3. If immediate patching is not possible, implement a temporary mitigation at the trust boundary by configuring consumer routes to strip the Long-Running-Action header using removeHeaders("Long-Running-Action").
4. Audit existing saga-enabled routes to determine if they are exposed to untrusted external input.