Apache Camel CVE-2026-49099 Security Advisory: Header Injection Leading to SQL Injection and Unauthorized Access

Apache Camel Security Advisory: CVE-2026-49099 Vulnerability Overview Severity: Medium Summary: Exchange header constants without the Camel prefix (such as , , , etc.) can bypass HTTP header restrictions, allowing HTTP clients to inject SQL/SOQL queries, overwrite target data, and redirect Apex REST calls. This exploitation leverages the permissions of the Salesforce-connected user. Description: The Camel-Salesforce producer prioritizes reading its operation parameters (SOQL queries, SOQL searches, target name and ID, Apex REST URL and method, and Apex query parameters) from Exchange message headers rather than from endpoint configuration. The constants controlling these headers are defined in (e.g., , , , , , , and the prefix) and utilize values without the Camel prefix. Since these names do not start with "Camel" or a Camel-specific prefix handled by , they are passed directly across the HTTP boundary to the Salesforce producer. In routes bridging an HTTP consumer (such as from ) to a Salesforce producer, any HTTP client can set these headers to override the route's intended behavior. This allows attackers to provide their own SOQL queries or SOQL searches to read any data, overwrite the target name and ID to perform CRUD operations, or redirect Apex REST calls to different endpoints and HTTP methods (including destructive methods) while injecting query parameters. All such operations execute with the full permissions of the Salesforce-connected (integration) user, which typically encompasses a broad scope when the bridging consumer is unauthenticated. Affected Versions Affected Versions: - 4.0.0 through 4.14.8 - 4.15.0 through 4.18.3 - 4.19.0 through 4.21.0 Fix and Mitigation Fixed Versions: 4.14.8, 4.18.3, and 4.21.0 Mitigations: - Users are advised to upgrade to version 4.21.0. - For users on the 4.14.x LTS release train, it is recommended to upgrade to 4.14.8. - For users on the 4.18.x release train, it is recommended to upgrade to 4.18.3. - After upgrading, routes setting Salesforce operation parameters should use CamelSalesforce naming conventions (e.g., and ) instead of the legacy or values; endpoint option spelling remains unchanged. - For deployments that cannot upgrade immediately, Salesforce control headers should be stripped from untrusted inputs at the beginning of the route (e.g., using and ), and the and Apex parameters should be set explicitly. References PGP signed advisory data: CVE-2026-49099.txt.asc Mitre CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-49099 Credits This vulnerability was discovered by Yao Bao from PayPal. --- Note**: No specific Proof of Concept (POC) or exploit code is included in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel CVE-2026-49099 Security Advisory: Header Injection Leading to SQL Injection and Unauthorized Access