CVE-2026-78164

CVE-2026-78164 affects the HTTP producers in Apache Camel: camel-http, camel-netty-http, camel-undertow and camel-vertx-http. Apache published the advisory on 15 October 2026. The CVE record and NVD entry followed on 19 October.

A message can override the target URL through the CamelHttpUri and CamelRestHttpUri headers. The producers passed that string through Camel's property-placeholder resolution before use.

That resolver reaches environment variables, JVM system properties and the secret functions for AWS, Azure, GCP, HashiCorp, IBM, CyberArk and Kubernetes. Through camel-bean, it can also call no-argument methods on registry beans.

So a sender who can influence those headers could get configuration values and vault secrets expanded into the outbound request. The route author did not have to opt in; a plain static HTTP call was enough.

Several Camel HTTP consumers fill CamelHttpUri from the request line themselves, as a reverse-proxy feature. Apache says that means header injection was not always needed. The bridgeEndpoint option does not fully block it.

Apache scores it CVSS 3.1 8.2 (High) and calls the sender unauthenticated. NVD shows the Apache score and has not added its own.

Affected: 4.0.0 before 4.18.5, and 4.19.0 before 4.22.1. Fixed: 4.18.5, 4.22.1 and 4.23.0. Older lines are affected too but are end of life.

Before you can upgrade, Apache suggests removing both override headers at the trust boundary. On camel-http only, the skipControlHeaders option also helps.

The advisory credits a reporter listed only by a QQ Mail address. A public reproducer repository is published by Andrea Cosentino (oscerd), the Camel PMC member who wrote the fix. ThreatWire did not run it.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23). CISA's SSVC entry sets exploitation to none.

Read the full explainer on the eight Camel and Camel K flaws. A second camel-http credential flaw is CVE-2026-85251.