Input Validation Flaw in Apache Camel Kafka Component Affects Data Integrity
CVE-2026-49098

5.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
6 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-49098?

The Apache Camel Kafka Component is susceptible to an input validation flaw that enables an attacker to manipulate the target Kafka topic at runtime. Specifically, the kafka.OVERRIDE_TOPIC header can be exploited to publish messages to arbitrary, potentially sensitive topics, bypassing predefined configurations. This vulnerability arises because the KafkaProducer evaluates the header value over the configured topic without adequate validation. In multi-component routes, unfiltered kafka.* headers can be injected, allowing unauthorized clients to overwrite key Kafka headers, including kafka.OVERRIDE_TIMESTAMP and kafka.PARTITION_KEY, thus enabling attackers to influence message timing and partitioning. To mitigate this issue, upgrading to version 4.21.0 or implementing header validation strategies is strongly recommended.

Affected Version(s)

Apache Camel 4.0.0 < 4.14.8

Apache Camel 4.15.0 < 4.18.3

Apache Camel 4.19.0 < 4.21.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-49098
Created by oscerd

References

https://camel.apache.org/security/CVE-2026-49098.html
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao from PayPal
Andrea Cosentino
.