CVE-2026-49099
Description
A flaw was found in Apache Camel Salesforce. Due to improper neutralization of special elements, non-Camel-prefixed HTTP headers are not filtered, allowing them to pass from an inbound HTTP request. A remote, unauthenticated attacker can exploit this by injecting malicious headers to override intended operations. This enables unauthorized access to Salesforce data through custom SOQL/SOSL queries, modification of SObject operations, or redirection of Apex REST calls with the full permissions of the connected Salesforce user.
Statement
This Moderate vulnerability in Apache Camel Salesforce component allows an unauthenticated HTTP client to bypass header filtering in routes that bridge an HTTP consumer to a Salesforce producer. An attacker can inject arbitrary Salesforce operation parameters, potentially leading to unauthorized data access, modification, or redirection of Apex REST calls with the full permissions of the connected Salesforce user. This risk is present when the affected component is deployed in a vulnerable bridging configuration.
Mitigation
To mitigate this issue, configure affected Apache Camel routes to strip Salesforce control headers from any untrusted ingress before they reach the `camel-salesforce` producer. This can be achieved by adding `removeHeaders('sObject*')` and `removeHeaders('apex*')` at the beginning of the route. Ensure that Salesforce operation parameters are subsequently set from a trusted source within the route. Redeployment of the affected route or application may be required for the changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
