Improper Input Validation Vulnerability in Apache Camel Mail Component
CVE-2026-46584

3.7LOW

Key Information:

Vendor

Apache
Status
Apache Camel Mail
Vendor
CVE Published:
6 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-46584?

An improper input validation vulnerability in the Apache Camel Mail Component allows for the potential exposure of sensitive information due to untrusted input being processed without proper filtering. Specifically, the MailProducer may construct JavaMail sessions with headers from untrusted sources, leading to the risk of credential exposure or weakened security during email transmission. The vulnerability affects several versions and can be mitigated by upgrading to the latest version or by implementing header filtering practices.

Affected Version(s)

Apache Camel Mail 4.0.0 < 4.14.8

Apache Camel Mail 4.15.0 < 4.18.3

Apache Camel Mail 4.19.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-46584
Created by oscerd

References

https://camel.apache.org/security/CVE-2026-46584.html
vendor-advisory

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao from PayPal
.