{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-spring-boot-4.0.0-4.22.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":4.8,"id":"CVE-2026-85312"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-core (4.0.0-4.18.4, 4.19.0-4.22.0)","camel-spring-boot (4.0.0-4.22.0)","camel-quarkus-saga (4.0.0-4.22.0)"],"_cs_severities":["low"],"_cs_tags":["camel","middleware","vulnerability","cve-2026-85312"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel versions 4.x before 4.18.5 and 4.19.0 through 4.22.0 are vulnerable to a saga hijacking flaw identified as CVE-2026-85312. The vulnerability resides in the \u003ccode\u003eSagaProcessor\u003c/code\u003e component, which improperly trusts the \u003ccode\u003eLong-Running-Action\u003c/code\u003e message header when determining the current saga coordinator. Because this header lacks a 'Camel' prefix, it is not stripped by standard consumer header filters, allowing an external sender to inject the header into inbound messages.\u003c/p\u003e\n\u003cp\u003eBy supplying a specific identifier in the \u003ccode\u003eLong-Running-Action\u003c/code\u003e header, an attacker can influence which saga an exchange joins. This allows the attacker to associate their request with an existing long-running action initiated by another party or force the system to perform compensation actions incorrectly. This exposure is limited to deployments actively utilizing the Saga EIP. Apache has released patches in versions 4.18.5 and 4.22.1 to ensure the header is only consulted if the configured saga service explicitly supports the protocol.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthorized party to manipulate long-running transaction workflows within an Apache Camel application. This can result in unauthorized participation in sagas, misrouting of transactions, or the execution of compensation logic for actions the attacker did not initiate. The impact is significant for financial or enterprise integration workflows where saga consistency and transaction integrity are required.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Apache Camel installations to version 4.18.5, 4.22.1, or 4.23.0 to incorporate the fix for CVE-2026-85312.\u003c/li\u003e\n\u003cli\u003eFor environments running Camel Quarkus, upgrade to version 3.40.0 or later to receive the patched Camel 4.22.1 core.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement a temporary mitigation at the trust boundary by configuring consumer routes to strip the \u003ccode\u003eLong-Running-Action\u003c/code\u003e header using \u003ccode\u003eremoveHeaders(\u0026quot;Long-Running-Action\u0026quot;)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit existing saga-enabled routes to determine if they are exposed to untrusted external input.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T14:43:09Z","date_published":"2026-10-20T14:43:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-saga-hijacking/","summary":"An input validation vulnerability in Apache Camel’s SagaProcessor allows unauthorized actors to hijack saga associations via the Long-Running-Action header, potentially leading to incorrect compensation or workflow manipulation.","title":"Apache Camel: Saga processor header hijacking (CVE-2026-85312)","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-saga-hijacking/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Spring-Boot (4.0.0-4.22.0)","version":"https://jsonfeed.org/version/1.1"}