{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-camel-4.7.0-4.18.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-78164"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache Camel (4.0.0-4.18.4, 4.19.0-4.22.0)","Apache Camel (4.0.0 \u003c= 4.18.4, 4.19.0 \u003c= 4.22.0)","Apache Camel (4.7.0-4.18.4)","Apache Camel (4.19.0-4.22.0)"],"_cs_severities":["high"],"_cs_tags":["apache","camel","remote-code-execution","information-disclosure","template-injection","cloud","xml-external-entity","xxe","vulnerability","java"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel components (Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP) contain a critical vulnerability, CVE-2026-78164, involving improper neutralization of template engine elements. The Camel HTTP producer families incorrectly process inbound headers CamelHttpUri and CamelRestHttpUri by passing them through CamelContext.resolvePropertyPlaceholders().\u003c/p\u003e\n\u003cp\u003eThis resolution mechanism is intended for configuration and is not a secure URI-parsing step. It grants attackers access to OS environment variables, JVM system properties, cloud secret stores (AWS, Azure, GCP, HashiCorp, IBM, CyberArk, and Kubernetes), and the ability to invoke no-argument methods on any bean registered within the application context. Attackers can trigger this via direct header injection or, in certain reverse-proxy configurations, by manipulating the request line. The vulnerability allows for information disclosure of sensitive configuration data and potential remote code execution through secondary exploitation of reachable beans. This issue impacts Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to the exposure of sensitive secrets, environment configuration, and potential unauthorized code execution via bean invocation. This impacts any organization running Apache Camel HTTP components exposed to untrusted input, particularly in cloud-native environments where secret stores are integrated directly into the Camel context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch immediately: Upgrade to Apache Camel 4.23.0, 4.22.1, or 4.18.5 as per the affected version stream.\u003c/li\u003e\n\u003cli\u003eMitigation (short-term): For deployments unable to patch, implement a HeaderFilterStrategy to strip CamelHttpUri and CamelRestHttpUri headers at the trust boundary before they reach the producer.\u003c/li\u003e\n\u003cli\u003eMitigation (short-term): Enable skipControlHeaders=true on camel-http endpoints where applicable, though this is not available for all affected components.\u003c/li\u003e\n\u003cli\u003eConfiguration: Avoid storing secrets in environment variables or system properties that are resolvable via Camel placeholders; migrate secrets to a dedicated, restricted-access vault service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T12:03:54Z","date_published":"2026-10-19T12:03:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-cve-2026-78164/","summary":"Vulnerabilities in Apache Camel HTTP producers allow unauthenticated users to trigger arbitrary property resolution and bean method invocation via manipulated CamelHttpUri or CamelRestHttpUri headers.","title":"Apache Camel Template Injection via HTTP Producer Headers","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-cve-2026-78164/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache Camel (4.7.0-4.18.4)","version":"https://jsonfeed.org/version/1.1"}