Improper Neutralization of Special Elements in Apache Camel HTTP Components
CVE-2026-78164

8.2HIGH

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78164?

This vulnerability allows an inbound message in Apache Camel to manipulate the endpoint URI by exploiting the CamelHttpUri and CamelRestHttpUri headers, leading to the exposure of sensitive information. It affects multiple HTTP components, including those integrated with popular cloud services and secret management systems. The issue arises during the resolution of property placeholders, turning static URI strings into dynamic resolution contexts that could inadvertently disclose sensitive information. Users are advised to upgrade to the latest version or implement workarounds to mitigate risk.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.15.0 < 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78164
Created by oscerd