CVE-2026-49086

{"id": "CVE-2026-49086", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49086", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T19:04:19.786692Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Camel Dapr", "versions": [{"status": "affected", "version": "4.12.0", "lessThan": "4.14.8", "versionType": "semver"}, {"status": "affected", "version": "4.15.0", "lessThan": "4.18.3", "versionType": "semver"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.21.0", "versionType": "semver"}], "packageName": "org.apache.camel:camel-dapr", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-07-06T09:16:38.120", "references": [{"url": "https://camel.apache.org/security/CVE-2026-49086.html", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/05/21", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-441"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component.\n\nThe camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from('dapr-pubsub:p:t').to('dapr-pubsub:p:other')), an actor able to publish a message to the subscribed topic could set the CloudEvent's pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route's intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed.\nThis issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, remove the CamelDaprPubSubName and CamelDaprTopic headers from the Exchange between the Dapr consumer and any Dapr producer in the route (for example removeHeaders('CamelDaprPubSubName', 'CamelDaprTopic')), and restrict who can publish to the subscribed Dapr Pub/Sub topic so that only trusted producers can send to it."}, {"lang": "es", "value": "Validaci\u00f3n de entrada incorrecta, vulnerabilidad de Proxy o Intermediario no intencionado (\u2019Delegado Confundido\u2019) en el componente DAPR de Apache Camel.\n\nEl consumidor Dapr Pub/Sub de camel-dapr (DaprPubSubConsumer) copi\u00f3 dos campos de cada CloudEvent entrante - su nombre de componente Pub/Sub y su tema - en los encabezados de intercambio CamelDaprPubSubName y CamelDaprTopic. Estos dos encabezados son encabezados de enrutamiento en direcci\u00f3n al productor: cuando la ruta republica a trav\u00e9s de un productor Dapr, DaprConfigurationOptionsProxy los lee de nuevo y los prefiere sobre el destino configurado en el punto final. Como resultado, en una ruta que consume de un tema Dapr Pub/Sub y republica a otro (por ejemplo, from(\u2019dapr-pubsub:p:t\u2019).to(\u2019dapr-pubsub:p:other\u2019)), un actor capaz de publicar un mensaje en el tema suscrito podr\u00eda establecer el nombre de pub/sub y el tema del CloudEvent a valores de su elecci\u00f3n y hacer que el mensaje republicado se entregue a un componente y tema Dapr Pub/Sub arbitrario en lugar del destino configurado - redirigiendo o exfiltrando el mensaje y eludiendo el enrutamiento previsto de la ruta y cualquier control de acceso a nivel de tema en el intermediario subyacente. La explotaci\u00f3n requiere la capacidad de publicar en el tema al que se suscribe la ruta; no se necesita otra autenticaci\u00f3n ni interacci\u00f3n del usuario.\nEste problema afecta a Apache Camel: desde 4.12.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.21.0, que corrige el problema. Si los usuarios est\u00e1n en la rama de versiones LTS 4.14.x, se sugiere que actualicen a 4.14.8. Si los usuarios est\u00e1n en la rama de versiones 4.18.x, se sugiere que actualicen a 4.18.3. Para las implementaciones que no pueden actualizarse inmediatamente, elimine los encabezados CamelDaprPubSubName y CamelDaprTopic del Intercambio entre el consumidor Dapr y cualquier productor Dapr en la ruta (por ejemplo, removeHeaders(\u2019CamelDaprPubSubName\u2019, \u2019CamelDaprTopic\u2019)), y restrinja qui\u00e9n puede publicar en el tema Dapr Pub/Sub suscrito para que solo los productores de confianza puedan enviar a \u00e9l."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E11116FE-0265-47C9-BF4E-C129E050E736", "versionEndExcluding": "4.14.8", "versionStartIncluding": "4.12.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270", "versionEndExcluding": "4.18.3", "versionStartIncluding": "4.15.0"}, {"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED", "versionEndExcluding": "4.21.0", "versionStartIncluding": "4.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}