Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified. Because a CometdComponent installs no Bayeux SecurityPolicy by default, any client that can complete the Bayeux handshake against the CometD endpoint can publish such a message without authentication. An attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a JMS destination); the injected headers also persist across internal direct, seda and vm hops. The concrete downstream impact depends on which producers the route uses. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that cannot upgrade immediately, strip the Camel control headers from inbound CometD messages before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), and install an explicit Bayeux SecurityPolicy on the CometdComponent so that only authenticated clients can publish.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps
    inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy.
    CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD
    client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal
    control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified.
    Because a CometdComponent installs no Bayeux SecurityPolicy by default, any client that can complete the
    Bayeux handshake against the CometD endpoint can publish such a message without authentication. An
    attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream
    producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a
    JMS destination); the injected headers also persist across internal direct, seda and vm hops. The concrete
    downstream impact depends on which producers the route uses. This issue affects Apache Camel: from 4.0.0
    before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to
    version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are
    suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to
    upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing
    TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so
    client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that
    cannot upgrade immediately, strip the Camel control headers from inbound CometD messages before they reach
    any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of
    the route), and install an explicit Bayeux SecurityPolicy on the CometdComponent so that only
    authenticated clients can publish. (CVE-2026-46454)

ID	Name	Product	Family	Type	Severity
446361	SCA: security update for org.apache.camel:camel-cometd (GHSA-r9cc-j7wr-p329)	Tenable Cloud Security	SCA Checks	Local	critical
446361	SCA: security update for org.apache.camel:camel-cometd (GHSA-r9cc-j7wr-p329)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-46454

critical

Tenable Plugins

critical

critical