Severity:
CVSS 3.1: 4.8 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-core) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-core) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-core) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-core) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-core) 4.23.0 unaffected
Description:
Improper Input Validation vulnerability in Apache Camel Core component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
The saga processor consulted a header named Long-Running-Action to decide which
saga an exchange belonged to. The name carries no Camel prefix, so it sits
outside the namespace that consumer header filters block, and an external
sender could supply it on an inbound message. That let the sender name the saga
the exchange joined, attaching their request to a long-running action started
by someone else, or causing compensation to be associated with an action they
did not initiate. The header is only consulted by a saga service that uses it,
which bounds the exposure to deployments running sagas over an LRA coordinator.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The header is now consulted only for a saga
service that actually uses it, rather than on every exchange. For deployments
that cannot upgrade immediately, strip the header at the trust boundary with
removeHeaders("Long-Running-Action") on every consumer that accepts messages
from an untrusted sender.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The header is now consulted only for a saga
service that actually uses it, rather than on every exchange.
Work Arounds:
For deployments that cannot upgrade immediately, strip the header at the trust
boundary with removeHeaders("Long-Running-Action") on every consumer that
accepts messages from an untrusted sender.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-85312.html
https://issues.apache.org/jira/browse/CAMEL-24449
https://github.com/apache/camel/pull/25828
https://github.com/apache/camel/pull/25940
https://github.com/apache/camel/pull/25942
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85312
