Improper Input Validation in Apache Camel's Knative Component

CVE-2026-63621

What is CVE-2026-63621?

The Apache Camel Knative component contains a vulnerability that allows unauthenticated attackers to inject Camel-internal headers through structured-mode CloudEvent requests. This occurs when CloudEvent extension fields are read directly from JSON bodies, bypassing essential header filter strategies. Consequently, attackers can manipulate headers such as CamelHttpUri and CamelHttpPath, potentially leading to server-side request forgery (SSRF), path traversal, or message-dispatch redirection. Users are urged to upgrade to the latest versions to mitigate this vulnerability effectively.

References