CVE-2026-48204 – Unauthenticated File Read, Deletion & NoSQL Injection – Apache Camel camel-mongo…

Summary

CVE-2026-48204 is a critical Improper Input Validation and Improper Access Control vulnerability (CVSS 9.8) in the camel-mongodb-gridfs component of Apache Camel. Because the component’s control headers use plain, non-prefixed names that are not filtered at the HTTP boundary, any unauthenticated remote attacker can inject those headers into an inbound HTTP request and take full control of GridFS operations, including reading, deleting, and enumerating stored files, as well as injecting NoSQL operators into MongoDB queries. All Apache Camel deployments running an HTTP-consumer-to-GridFS route in the default (no explicit operation) configuration are affected.

Technical details

• Root cause: The camel-mongodb-gridfs producer reads the GridFS operation to execute from the Exchange header gridfs.operation whenever the endpoint’s operation parameter is not set — which is the default. The underlying header constants (gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, gridfs.fileid) do not carry the Camel/camel prefix. Because HttpHeaderFilterStrategy only blocks headers in the Camel namespace, these headers pass freely from an inbound HTTP request into the Exchange without any sanitisation.

• Trigger conditions: A route that bridges any HTTP consumer component (e.g. platform-http, camel-servlet, camel-jetty, camel-undertow) into a mongodb-gridfs: producer without an explicit operation set on the endpoint — the default configuration.

• Attack vector: An unauthenticated remote attacker sends an HTTP request with crafted headers to the exposed Camel endpoint. No credentials or user interaction are required.

• Impact:

  • Arbitrary file deletion — set gridfs.operation: remove together with an attacker-chosen gridfs.objectid to delete any file in the GridFS bucket.

  • Full file enumeration — use gridfs.operation: listAll to retrieve a listing of every file in the bucket.

  • Arbitrary file read / data exfiltration — use gridfs.operation: findOne to read any file from the bucket, compromising confidentiality.

  • NoSQL operator injection — supply a MongoDB query operator in the gridfs.metadata header, which is parsed as a raw MongoDB document.

Affected software

• Apache Camel (camel-mongodb-gridfs) 4.0.0 through 4.14.7

• Apache Camel (camel-mongodb-gridfs) 4.15.0 through 4.18.2

• Apache Camel (camel-mongodb-gridfs) 4.19.0 through 4.20.x

Severity

CVSS v3.1 Base Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate — patch: Upgrade to one of the following fixed releases:

  • 4.21.0 (latest general release — recommended)

  • 4.14.8 (4.14.x LTS stream)

  • 4.18.3 (4.18.x maintenance stream)

• Post-upgrade: Any route logic that drives GridFS operations or metadata via header names must be updated to use the new Camel-prefixed constants: CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize, and CamelGridFsFileId in place of the legacy gridfs.* names.

• If immediate patching is not feasible:

  • Set an explicit operation parameter on every mongodb-gridfs: endpoint in your routes so that the operation is never derived from a request header.

  • Strip the gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, and gridfs.fileid headers from all untrusted inbound traffic before the request reaches the GridFS producer.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

WAF Mitigation ✨

Akamai App & API Protector

In Akamai Control Center (Security Configuration → your security policy → Custom Rules → Create a custom rule):

• Rule logic: match ANY of the following (OR)

• Add five conditions, each set to Request Header → header name → exists:

  • gridfs.operation

  • gridfs.objectid

  • gridfs.metadata

  • gridfs.chunksize

  • gridfs.fileid

You can also add this custom rule via Akamai API/CLI or the Akamai Custom Rule Builder Assistant:

{
  "name": "Apache-Camel-CVE-2026-48204-GridFS-header-block",
  "description": "Denies inbound requests smuggling internal Camel GridFS control headers (gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize, gridfs.fileid) into camel-mongodb-gridfs routes. CVE-2026-48204.",
  "structured": true,
  "operation": "OR",
  "conditions": [{
    "type": "requestHeaderMatch",
    "positiveMatch": true,
    "name": ["gridfs.operation", "gridfs.objectid", "gridfs.metadata", "gridfs.chunksize", "gridfs.fileid"],
    "nameWildcard": false,
    "value": ["*"],
    "valueWildcard": true,
    "valueCase": false
  }],
  "ruleActivated": true,
  "stagingOnly": false,
  "samplingRate": 100,
  "tag": ["CVE-2026-48204"]
}

Deploy to Akamai App & API Protector

Cloudflare WAF

Under Security → WAF → Custom rules → Create rule → "Edit expression":

any(lower(http.request.headers.names[*])[*] in {"gridfs.operation" "gridfs.objectid" "gridfs.metadata" "gridfs.chunksize" "gridfs.fileid"})

Deploy to Cloudflare WAF

⚠️ Note: WAF mitigation rules are in preview and not yet generally available.

References

• CVE-2026-48204 at NIST
• Apache Camel Security Advisory – CVE-2026-48204
• OSS Security Disclosure