CVE-2026-46592
Apache Camel 4.0.0 – 4.14.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-46592 is a high-severity Improper Input Validation (CWE-20) vulnerability in Apache Camel. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-41836
Vulnerability Data
Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME…
more
/ OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and have CxfProducer resolve and invoke a different WSDL operation than the route intended - for example replacing a read operation with a destructive one - against the backend SOAP service (a confused-deputy redirection). The constant is defined in the shared camel-cxf-common module, so the same non-prefixed names also applied to camel-cxfrs. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern. For deployments that cannot upgrade immediately, do not select the CXF operation from untrusted input: strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer and set the operation from a trusted source in the route.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 3 OS baselines
V3.2.1V3.5.1V3.5.3V3.5.8
Mitigating Controls (NIST 800-53 r5) AI
Associating and preserving security attributes such as original source identity prevents the loss of provenance that creates the confused deputy.
Information flow enforcement requires preserving and checking source attributes before forwarding requests outside the trust boundary.
Developer testing and evaluation can discover missing input validation through analysis or test cases.
SI-10 directly requires validity checks on information inputs, structurally preventing improper or missing validation.
Access enforcement directly stops a component from acting on forwarded requests without verifying original source authorizations.
Requiring documented development standards and tools can embed input-validation practices into the engineering process.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
Secure SDLC practices directly require and enforce input validation during development.
Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.
Network-security controls can enforce source validation and prevent the product from blindly proxying traffic to external actors.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
RHEL 8 (1 rule)
- V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-20