CVE-2026-71300
Description
A flaw was found in Apache Camel Atmosphere Websocket. This improper input validation vulnerability allows a remote attacker to inject specific Exchange headers, such as websocket.connectionKey.list, which are not properly filtered. By manipulating these headers, an attacker can take control of the message dispatch decision, leading to a notification being suppressed or redirected to an unintended client. This could result in information disclosure or a denial of service.
Statement
This is an Important vulnerability in the Apache Camel Atmosphere Websocket component, affecting Red Hat JBoss Fuse. An external attacker can exploit improper input validation to manipulate WebSocket dispatch headers, leading to information disclosure by redirecting messages to unintended clients or denial of service by suppressing messages. This risk is present in deployments where an untrusted HTTP consumer is bridged directly into an atmosphere-websocket producer without intermediate header sanitization.
Mitigation
To mitigate this issue, configure your Apache Camel routes to strip dispatch headers at the trust boundary before the atmosphere-websocket producer. For example, insert `removeHeaders("websocket.*")` between the HTTP consumer and the atmosphere-websocket producer in your route definition. This action prevents an external sender from controlling message dispatch. Ensure to test this configuration change thoroughly, as it may impact existing routing logic that relies on these headers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
