CVE-2026-46592
Description
A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the operationName header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the CxfProducer to invoke unintended SOAP operations on the backend service. This could lead to a 'confused deputy' scenario, where a read operation is replaced with a destructive one, impacting the integrity of the backend service.
Statement
This is an Important flaw in the Apache Camel CXF SOAP component, allowing a remote, unauthenticated attacker to manipulate SOAP operation names via HTTP headers. When an HTTP consumer bridges into a cxf: producer, an attacker can force the backend service to execute unintended operations, potentially replacing read operations with destructive ones. This 'confused deputy' scenario impacts the integrity of services utilizing affected Red Hat build of Apache Camel and Enterprise Application Platform configurations.
Mitigation
To mitigate this issue, ensure that the `operationName` and `operationNamespace` headers are not sourced from untrusted input when bridging an HTTP consumer to a `cxf:` producer in Apache Camel routes. Configure the route to explicitly strip these headers from any untrusted ingress before they reach the `cxf:` producer. Subsequently, set the intended SOAP operation from a trusted, internal source within the route. This prevents a remote attacker from manipulating backend service operations. Changes to route configurations may require a service restart to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | High | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
