CVE-2026-46453

🗓️ 06 Jul 2026 07:55:56Reported by apacheType

cve🔗 web.nvd.nist.gov👁 207 Views🌐 WEB

Camel Elasticsearch Rest Client header bypass lets untrusted HTTP clients override queries.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for Authorization Bypass Through User-Controlled Key in Apache Camel	13 Jul 202612:30	–	githubexploit
ATTACKERKB	CVE-2026-46453	6 Jul 202607:55	–	attackerkb
BDU FSTEC	The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms	2 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-46453	5 Jul 202619:53	–	circl
Cvelist	CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202607:55	–	cvelist
EUVD	EUVD-2026-41827	6 Jul 202607:55	–	euvd
Github Security Blog	Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202609:30	–	github
Kitploit	CVE-2026-46453	31 Aug 202602:25	–	kitploit
NVD	CVE-2026-46453	6 Jul 202609:16	–	nvd
OSV	GHSA-RP9M-HFV5-PFVR Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202609:30	–	osv

NVD

Vulners

Node

apache camelRange4.3.0–4.14.8

apache camelRange4.15.0–4.18.3

apache camelRange4.19.0–4.21.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-elasticsearch-rest-client",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.8",
        "status": "affected",
        "version": "4.3.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.3",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-46453.html
openwall	www.openwall.com/lists/oss-security/2026/07/05/6

Parameter	Position	Path	Description	CWE
OPERATION	path	products	HTTP header injection via unprefixed headers bypassing inbound filter to override ES operation/query	CWE-20, CWE-639
SEARCH_QUERY	path	products	HTTP header injection via unprefixed headers bypassing inbound filter to override ES operation/query	CWE-20, CWE-639
INDEX_NAME	path	products	HTTP header injection via unprefixed headers bypassing inbound filter to override ES operation/query	CWE-20, CWE-639
INDEX_SETTINGS	path	products	HTTP header injection via unprefixed headers bypassing inbound filter to override ES operation/query	CWE-20, CWE-639
ID	path	products	HTTP header injection via unprefixed headers bypassing inbound filter to override ES operation/query	CWE-20, CWE-639
OPERATION	path	exploit/attack	Attack endpoint demonstrating header-based override to read entire Elasticsearch index	CWE-20, CWE-639
SEARCH_QUERY	path	exploit/attack	Attack endpoint demonstrating header-based override to read entire Elasticsearch index	CWE-20, CWE-639
INDEX_NAME	path	exploit/attack	Attack endpoint demonstrating header-based override to read entire Elasticsearch index	CWE-20, CWE-639
INDEX_SETTINGS	path	exploit/attack	Attack endpoint demonstrating header-based override to read entire Elasticsearch index	CWE-20, CWE-639
ID	path	exploit/attack	Attack endpoint demonstrating header-based override to read entire Elasticsearch index	CWE-20, CWE-639

07 Jul 2026 23:30Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

EPSS0.00552

SSVC