Detections
Analytics

SCA: security update for org.apache.camel:camel-cometd (GHSA-r9cc-j7wr-p329)

critical Tenable Self-Hosted Container Security Plugin ID 446361

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps
 inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy.
 CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD
 client directly onto the Camel message (message.setHeaders), so any header name - including Camel-internal
 control headers such as CamelHttpUri, CamelFileName or CamelJmsDestinationName - is accepted unmodified.
 Because a CometdComponent installs no Bayeux SecurityPolicy by default, any client that can complete the
 Bayeux handshake against the CometD endpoint can publish such a message without authentication. An
 attacker can therefore inject arbitrary Camel control headers that influence the behaviour of downstream
 producers in the route (for example redirecting an HTTP producer, changing a file name, or overriding a
 JMS destination); the injected headers also persist across internal direct, seda and vm hops. The concrete
 downstream impact depends on which producers the route uses. This issue affects Apache Camel: from 4.0.0
 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to
 version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are
 suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to
 upgrade to 4.18.3. The fix implements a HeaderFilterStrategy in the camel-cometd binding (a long-standing
 TODO in the code) that filters the Camel header namespace case-insensitively on inbound mapping, so
 client-supplied Camel* / camel* headers are no longer copied into the Exchange. For deployments that
 cannot upgrade immediately, strip the Camel control headers from inbound CometD messages before they reach
 any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of
 the route), and install an explicit Bayeux SecurityPolicy on the CometdComponent so that only
 authenticated clients can publish. (CVE-2026-46454)

Solution

Update the org.apache.camel:camel-cometd library and its related packages to version 4.14.8 or later.

See Also

https://github.com/advisories/GHSA-r9cc-j7wr-p329

Plugin Details

Severity: Critical

ID: 446361

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/26/2026

Updated: 8/26/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.07

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-46454

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/6/2026

Vulnerability Publication Date: 7/6/2026

Reference Information

CVE: CVE-2026-46454

cwe: CWE-20