Summary
CVE-2026-48203 is a critical Server-Side Request Forgery (SSRF) and header injection vulnerability in the Apache Camel camel-solr component, rated CVSS 9.1 (Critical). The flaw allows any unauthenticated HTTP client to inject arbitrary Solr request parameters and document fields by sending crafted HTTP headers, enabling SSRF attacks against internal services and cloud metadata endpoints. Exploitation requires no privileges or user interaction and is fully remote.
Technical details
- Root cause: The
camel-solrproducer maps Exchange message headers prefixed withSolrParam.directly into Solr request parameters, and headers prefixed withSolrField.directly into the fields of indexed Solr documents. Because neither prefix begins withCamelorcamel, Apache Camel’sHttpHeaderFilterStrategy— which only blocks headers in the Camel namespace — does not strip them at the HTTP boundary. Untrusted inbound HTTP headers therefore flow straight into the downstream Solr producer. - Trigger condition: A Camel route must bridge an HTTP consumer (e.g.,
platform-http,camel-jetty,camel-undertow, orcamel-servlet) into asolr:producer with no authentication on the ingress consumer. - Attack vector: An unauthenticated remote attacker sends an HTTP request carrying
SolrParam.*headers (e.g.,SolrParam.shards,SolrParam.stream.url,SolrParam.qt) orSolrField.*headers to the exposed Camel HTTP endpoint. - Impact:
- SSRF: Setting
SolrParam.shardsorSolrParam.stream.urlcauses the backend Solr server to issue HTTP requests to an attacker-controlled URL, enabling access to internal services or cloud instance metadata endpoints (e.g., AWS IMDSv1 at169.254.169.254). - Administrative handler access: Setting
SolrParam.qtredirects the Solr request to privileged administrative request handlers that are normally restricted. - Document field injection: Setting
SolrField.*headers allows an attacker to inject arbitrary fields into documents indexed by Solr, corrupting search data or poisoning the index.
- SSRF: Setting
Affected software
- Apache Camel 4.0.0 through 4.14.7
- Apache Camel 4.15.0 through 4.18.2
- Apache Camel 4.19.0 through 4.20.x
Severity
CVSS v3.1 Base Score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate — apply the vendor patch:
- Upgrade to Apache Camel 4.21.0 (recommended for all users).
- If on the 4.14.x LTS stream, upgrade to 4.14.8.
- If on the 4.18.x stream, upgrade to 4.18.3.
- After upgrading, routes that set Solr parameters or fields via header prefixes must be updated to use
CamelSolrParam.andCamelSolrField.in place of the oldSolrParam.andSolrField.prefixes.
- If immediate patching is not possible — apply the following workarounds:
- Strip all
SolrParam.*andSolrField.*headers from any untrusted ingress traffic before thesolr:producer processes the Exchange. - Set required Solr parameters and fields from a trusted, internal source within the route rather than from inbound HTTP headers.
- Strip all
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

