CVE-2026-46592

{"id": "CVE-2026-46592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46592", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T19:19:37.827133Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.14.8", "versionType": "semver"}, {"status": "affected", "version": "4.15.0", "lessThan": "4.18.3", "versionType": "semver"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.21.0", "versionType": "semver"}], "packageName": "org.apache.camel:camel-cxf-soap", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:37.380", "references": [{"url": "https://camel.apache.org/security/CVE-2026-46592.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/05/15", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-441"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component.\n\nThe camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and have CxfProducer resolve and invoke a different WSDL operation than the route intended - for example replacing a read operation with a destructive one - against the backend SOAP service (a confused-deputy redirection). The constant is defined in the shared camel-cxf-common module, so the same non-prefixed names also applied to camel-cxfrs. No credentials are required when the bridging consumer is unauthenticated.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern. For deployments that cannot upgrade immediately, do not select the CXF operation from untrusted input: strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer and set the operation from a trusted source in the route."}, {"lang": "es", "value": "Validaci\u00f3n de entrada incorrecta, vulnerabilidad de Proxy o Intermediario no intencionado (\u2019Delegado Confundido\u2019) en el componente SOAP de Apache Camel CXF.\n\nEl productor camel-cxf selecciona qu\u00e9 operaci\u00f3n SOAP invocar en el servicio de backend desde el encabezado Exchange operationName (y operationNamespace), cuyos valores constantes (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) eran las cadenas simples operationName / operationNamespace. Debido a que estos nombres no comienzan con el prefijo Camel / camel, HttpHeaderFilterStrategy - que bloquea solo el espacio de nombres del encabezado Camel en el l\u00edmite HTTP - los dej\u00f3 pasar de una solicitud HTTP entrante directamente al Exchange. En una ruta que conecta un consumidor HTTP (por ejemplo, platform-http) con un productor cxf:, cualquier cliente HTTP podr\u00eda, por lo tanto, establecer el encabezado operationName y hacer que CxfProducer resuelva e invoque una operaci\u00f3n WSDL diferente a la que la ruta pretend\u00eda - por ejemplo, reemplazando una operaci\u00f3n de lectura por una destructiva - contra el servicio SOAP de backend (una redirecci\u00f3n de delegado confundido). La constante est\u00e1 definida en el m\u00f3dulo compartido camel-cxf-common, por lo que los mismos nombres sin prefijo tambi\u00e9n se aplicaron a camel-cxfrs. No se requieren credenciales cuando el consumidor de conexi\u00f3n no est\u00e1 autenticado.\nEste problema afecta a Apache Camel: desde 4.0.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.21.0, que corrige el problema. Si los usuarios est\u00e1n en la rama de versiones LTS 4.14.x, se sugiere que actualicen a 4.14.8. Si los usuarios est\u00e1n en la rama de versiones 4.18.x, se sugiere que actualicen a 4.18.3. Despu\u00e9s de actualizar, los encabezados de selecci\u00f3n de operaci\u00f3n se denominan CamelCxfOperationName / CamelCxfOperationNamespace y se filtran en los l\u00edmites de transporte; consulte la gu\u00eda de actualizaci\u00f3n 4.21 para el patr\u00f3n de encabezado portador entre transportes. Para implementaciones que no pueden actualizarse inmediatamente, no seleccione la operaci\u00f3n CXF de entrada no confiable: elimine los encabezados operationName y operationNamespace de cualquier entrada no confiable antes del productor cxf: y establezca la operaci\u00f3n desde una fuente confiable en la ruta."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7662EB25-EAB6-493F-924C-5CA8A6F462B4", "versionEndExcluding": "4.14.8", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270", "versionEndExcluding": "4.18.3", "versionStartIncluding": "4.15.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED", "versionEndExcluding": "4.21.0", "versionStartIncluding": "4.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}