CVE-2026-55993 – SSRF and Secrets Disclosure – Apache Camel Atmosphere WebSocket (4.0.0 – 4.20.x)

Summary

CVE-2026-55993 is a high-severity Server-Side Request Forgery (SSRF) and sensitive information disclosure vulnerability in the camel-atmosphere-websocket component of Apache Camel, rated 7.5 (High) on the CVSS v3.1 scale. The flaw allows an unauthenticated remote attacker to inject Camel-internal control headers via WebSocket query parameters, redirecting server-side HTTP requests to arbitrary destinations and extracting environment variables, application properties, and vault secrets from the targeted server.

Technical details

• Root cause: The camel-atmosphere-websocket consumer copies all inbound WebSocket query parameters directly into the Camel Exchange header map without applying any HeaderFilterStrategy. The WebsocketConsumer.sendEventNotification() method iterates over the query-string map collected by WebsocketConsumer.service() and passes each entry into the Exchange without filtering the Camel header namespace.
• Trigger conditions: The vulnerability is exploitable in routes where a WebSocket consumer bridges to a downstream HTTP producer, and where the WebSocket endpoint is exposed without authentication. This is a common, idiomatic routing pattern within Apache Camel.
• Attack vector: An unauthenticated remote attacker connects to the vulnerable WebSocket endpoint and supplies the CamelHttpUri (i.e., Exchange.HTTP_URI) Camel control header as a query parameter.
• SSRF impact: The injected CamelHttpUri value overrides the intended HTTP producer target, redirecting the server-side HTTP request to an attacker-chosen destination — for example, internal services or cloud instance metadata endpoints (e.g., http://169.254.169.254/).
• Secrets disclosure impact: The HTTP producer resolves Camel property placeholders on the resulting attacker-controlled URI before making the request. An attacker can embed property placeholder expressions (e.g., environment variable references, application property keys, or vault secret references) in the injected URI value; the resolved plaintext values are transmitted to the attacker-controlled destination.

Affected software

• Apache Camel (camel-atmosphere-websocket) 4.0.0 up to and including 4.14.7
• Apache Camel (camel-atmosphere-websocket) 4.15.0 up to and including 4.18.2
• Apache Camel (camel-atmosphere-websocket) 4.19.0 up to and including 4.20.x

Severity

CVSS v3.1 Base Score: 7.5 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate – patch: Upgrade to one of the following fixed releases:
  • 4.21.0 (latest main-line release)
  • 4.14.8 (4.14.x LTS stream)
  • 4.18.3 (4.18.x release stream)
  • The fix enforces HeaderFilterStrategy on inbound WebSocket header mapping, filtering the Camel header namespace case-insensitively so that externally-supplied Camel* / camel* headers are no longer copied into the Exchange.
• If immediate upgrade is not possible – workarounds:
  • Add removeHeaders('Camel*') and removeHeaders('camel*') processor steps at the very start of any route that begins with a camel-atmosphere-websocket consumer, before messages reach any downstream producer.
  • Require authentication on all WebSocket endpoints to prevent unauthenticated access.
  • Avoid routing directly from an untrusted WebSocket consumer to an HTTP producer whose target URI can be influenced by message headers.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-55993 at NIST
• Apache Camel Security Advisory – CVE-2026-55993
• OSS Security Mailing List – CVE-2026-55993 Announcement