{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/kafka/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2026-49098"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache Camel (\u003e= 4.0.0 \u003c 4.14.8)","Apache Camel (\u003e= 4.15.0 \u003c 4.18.3)","Apache Camel (\u003e= 4.19.0 \u003c 4.21.0)"],"_cs_severities":["high"],"_cs_tags":["apache-camel","vulnerability","kafka","injection"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eA public exploit has been published for CVE-2026-49098, an improper input validation vulnerability affecting the \u003ccode\u003ecamel-kafka\u003c/code\u003e component in Apache Camel versions 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.9. This flaw allows for message-header injection where an attacker can supply specific \u003ccode\u003ekafka.*\u003c/code\u003e headers, such as \u003ccode\u003ekafka.OVERRIDE_TOPIC\u003c/code\u003e, in an HTTP request. When an Apache Camel route bridges an HTTP consumer to a Kafka producer without sufficient filtering, these headers are processed, allowing the attacker to override the intended target Kafka topic. This enables cross-topic message injection, where forged commands or messages can be directed into sensitive or privileged Kafka topics that the application was never designed to write to, compromising data integrity. The presence of a public exploit significantly elevates the risk for unpatched systems.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing Apache Camel application that routes HTTP requests to a Kafka producer, specifically utilizing the \u003ccode\u003ecamel-kafka\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request targeting the application's vulnerable endpoint (e.g., \u003ccode\u003e/feedback\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe request includes a specially crafted HTTP header, \u003ccode\u003ekafka.OVERRIDE_TOPIC\u003c/code\u003e, with a value corresponding to a sensitive Kafka topic (e.g., \u003ccode\u003eaccount-commands\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe Apache Camel application, due to improper input validation in the \u003ccode\u003eKafkaProducer.evaluateTopic()\u003c/code\u003e method, processes the \u003ccode\u003ekafka.OVERRIDE_TOPIC\u003c/code\u003e header without proper filtering by \u003ccode\u003eHttpHeaderFilterStrategy\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eInstead of sending the message to the application's pre-configured Kafka topic (e.g., \u003ccode\u003euser-feedback\u003c/code\u003e), the \u003ccode\u003ecamel-kafka\u003c/code\u003e component redirects the message to the attacker-specified topic.\u003c/li\u003e\n\u003cli\u003eThe forged message, containing attacker-chosen content (e.g., \u003ccode\u003e{\u0026quot;action\u0026quot;:\u0026quot;GRANT_ADMIN\u0026quot;,\u0026quot;account\u0026quot;:\u0026quot;attacker@evil.example\u0026quot;}\u003c/code\u003e), is injected into the sensitive Kafka topic.\u003c/li\u003e\n\u003cli\u003eA downstream service, consuming from the now-compromised Kafka topic, processes the malicious message, potentially leading to unauthorized actions or data manipulation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability, CVE-2026-49098, enables unauthenticated attackers to perform cross-topic message injection, leading to severe data integrity compromise. By injecting forged commands or messages into privileged Kafka topics, attackers can potentially trigger unauthorized actions, manipulate critical business logic, or introduce malicious data that could be consumed by downstream services. The observed impact includes the injection of commands like \u003ccode\u003eGRANT_ADMIN\u003c/code\u003e into an \u003ccode\u003eaccount-commands\u003c/code\u003e topic, directly enabling privilege escalation or other unauthorized administrative actions. Organizations using affected Apache Camel versions in environments bridging HTTP consumers to Kafka producers face a high risk of integrity violations if not patched.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-49098 immediately by upgrading Apache Camel to version 4.14.8, 4.18.3, or 4.21.0 to address the improper input validation.\u003c/li\u003e\n\u003cli\u003eAs an interim mitigation until upgrading, configure your Apache Camel routes to explicitly strip all \u003ccode\u003ekafka.*\u003c/code\u003e headers from untrusted ingress points before they reach the \u003ccode\u003ekafka:\u003c/code\u003e producer using a \u003ccode\u003eremoveHeaders(\u0026quot;kafka.*\u0026quot;)\u003c/code\u003e policy.\u003c/li\u003e\n\u003cli\u003eReview any existing Apache Camel routes that intentionally set Kafka topic, timestamp, or partition via headers; after upgrading, these routes must be updated to use the new \u003ccode\u003eCamelKafka*\u003c/code\u003e header naming convention as outlined in the Apache Camel 4.x upgrade guide.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T17:01:44Z","date_published":"2026-07-20T17:01:44Z","id":"https://feed.craftedsignal.io/briefs/2026-07-apache-camel-cve-2026-49098/","summary":"A public exploit has been released for CVE-2026-49098, an improper input validation vulnerability in Apache Camel's 'camel-kafka' component, which allows an attacker to perform message-header injection by supplying 'kafka.OVERRIDE_TOPIC' in HTTP headers, enabling cross-topic message injection and integrity compromise of sensitive Kafka topics.","title":"Public Exploit for Apache Camel CVE-2026-49098 Improper Input Validation","url":"https://feed.craftedsignal.io/briefs/2026-07-apache-camel-cve-2026-49098/"}],"language":"en","title":"CraftedSignal Threat Feed - Kafka","version":"https://jsonfeed.org/version/1.1"}