Remote Code Execution Vulnerability in Apache Camel's CoAP Component

CVE-2026-33453

What is CVE-2026-33453?

A vulnerability exists within Apache Camel's camel-coap component that allows an unauthenticated attacker to exploit message header injection. By sending a single CoAP UDP packet to a Camel route that accepts coap:// input, attackers can inject arbitrary Camel internal headers into the Exchange. This leads to unintended manipulation of producer behavior, potentially allowing an attacker to execute arbitrary OS commands. The exploitation requires minimal prerequisites and leverages the lack of built-in CoAP authentication, making it critical for users to upgrade to the secure versions promptly.

References