CVE-2026-46726
Description
A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery (SSRF), where the server is coerced into making requests to arbitrary internal or external destinations. Additionally, the flaw can result in the disclosure of sensitive information, including environment variables, application properties, and vault secrets.
Statement
A flaw was found in the Apache Camel Vertx-WebSocket component. The WebSocket consumer copies inbound query and path parameters into the Camel Exchange header map without applying a HeaderFilterStrategy. An attacker can inject Camel-internal control headers (such as CamelHttpUri) via WebSocket query parameters, causing SSRF when routed to an HTTP producer. The HTTP producer also resolves Camel property placeholders on the attacker-controlled URI, leaking environment variables, application properties, and vault secrets. Red Hat builds of Apache Camel for Spring Boot and Quarkus ship the affected camel-vertx-websocket component.
Mitigation
Restrict access to exposed WebSocket endpoints with authentication. If unable to upgrade, strip Camel-internal headers from inbound WebSocket messages before they reach downstream producers (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Access Control
Technical Impact: Bypass Protection Mechanism
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
