-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- ---
title: "Apache Camel Security Advisory - CVE-2026-46588"
date: 2026-07-03T10:00:00+02:00
url: /security/CVE-2026-46588.html
draft: false
type: security-advisory
cve: CVE-2026-46588
severity: MEDIUM
summary: "Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input"
description: "The camel-couchdb component reads several Exchange headers to control its behaviour - CouchDbDatabase (the database name), CouchDbSeq (the changeset sequence number), CouchDbId (the document id), CouchDbRev (the document revision) and CouchDbMethod (the operation method). The string values of these header constants, defined in CouchDbConstants, use the CouchDb prefix rather than the standard Camel prefix used by every other Camel component (for example CamelSqlQuery, CamelMongoDbCriteria). Camel's inbound HTTP header filter, HttpHeaderFilterStrategy, blocks only header names that begin with Camel or camel. Because the CouchDB header names do not carry the Camel prefix, they pass through the inbound filter unchanged. When a Camel route exposes an HTTP entry point (for example platform-http) in front of a couchdb producer, an untrusted HTTP client can set these headers directly on its request and override the database, document id, revision or method that the route author configured. No credentials are required when the HTTP consumer is unauthenticated."
mitigation: "Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix renames the camel-couchdb Exchange header constant string values (CouchDbDatabase, CouchDbSeq, CouchDbId, CouchDbRev, CouchDbMethod) to carry the Camel prefix (CamelCouchDbDatabase, CamelCouchDbSeq, CamelCouchDbId, CamelCouchDbRev, CamelCouchDbMethod) so that they are blocked by the inbound HttpHeaderFilterStrategy; the Java constant field names are unchanged. For deployments that cannot upgrade immediately, strip the affected headers from untrusted inbound messages before they reach the producer (for example removeHeader('CouchDbDatabase'), removeHeader('CouchDbId'), removeHeader('CouchDbRev'), removeHeader('CouchDbSeq') and removeHeader('CouchDbMethod') in front of the couchdb endpoint), or apply a custom HeaderFilterStrategy that blocks these names."
credit: "This issue was discovered by Yu Bao from PayPal"
affected: "From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0."
fixed: 4.14.8, 4.18.3 and 4.21.0
- ---

The fix was merged on main in https://github.com/apache/camel/pull/23228 (commit f35286f9eaee6740482e6ef11f8c68d785c49567) and backported to camel-4.18.x in https://github.com/apache/camel/pull/23230 (commit 8d74cdca9befc74b49d9c52ac6a145be1d413e7d) and camel-4.14.x in https://github.com/apache/camel/pull/23231 (commit c16f7ef39849ae8819f50c959b538350b8f839e9). The issue is classified as CWE-20 (Improper Input Validation). It belongs to the same Camel message-header-injection family as CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-46453 and CVE-2026-47323, all of which stem from Camel components reading inbound message headers that the default HeaderFilterStrategy does not block because the header names do not start with the Camel prefix. The fix shares its PR with the sibling advisory CVE-2026-46587 (camel-couchbase).
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEXhypCOH+Pe54HVUTBwmP38yc5+YFAmpLW7wbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEAcJj9/MnOfm748P/27KuUx4hgCyfpkdM8bS
MgILeg4T/vaCShvlzHklBAG3ZYWKMeJDWNWdnXHG8LOQhSM3i1MOI+uhPCyCGbXS
s2LH2vsQorBw3nlWtJNr5B1vDXiBQBWE0vKswkP4zrP6ArhrkUXJW7kQ4QUUco4w
xK6Vp4/QmpowoZ6uFoX8usU971xNkHQaEjOzYI/qPiz8R1kbD+sM8LyIIDzbkSTJ
JjSZ55YvQ3xTf482YrDDxATsGGc9Ns3Z+WwU48ZYryn0epqAwnniX/nsr1ESibW6
JD0GzRmP5eTvYIaZh0094bky266RYGGpl7/+4zW6todYaW69Nhx6jEdECiQH8Eth
p2oFw8vameMqVlRVdAslOBkauFyijh1vOVydoUV9T5Nh6PbovEFTgpA6aKgcl2be
DWp97fsusR5Xd5tah85DycsJw50GIPYRZOOMGjXd+Ja/GaR2r5uKYjCOfZUuWToh
FzZIs2f2QveUN16zsxm+ACM4EYJ2P8hyI1VTiIWiDiQ2PHxz1BK6tvdC1E8F7dr8
Id9EtTAusrCUttczCgjXk2F61Xl1DaUU7dztDw4BoqLbCfIAq47mKcyQisughqmQ
lsW83dTj1KhypIxcMEf3QjTH1p+7zpdcXlvDd/pWFT1NUK0b/zw64FYryJU1wCg6
T4Zngv3yJw4OV3+9ujiCb3DT
=m41K
-----END PGP SIGNATURE-----