CVE-2026-46453

🗓️ 06 Jul 2026 07:55:56Reported by apacheType

cve🔗 web.nvd.nist.gov👁 19 Views🌐 WEB

Camel Elasticsearch Rest Client header bypass lets untrusted HTTP clients override queries.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for Authorization Bypass Through User-Controlled Key in Apache Camel	13 Jul 202612:30	–	githubexploit
ATTACKERKB	CVE-2026-46453	6 Jul 202607:55	–	attackerkb
Circl	CVE-2026-46453	5 Jul 202619:53	–	circl
Cvelist	CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202607:55	–	cvelist
EUVD	EUVD-2026-41827	6 Jul 202607:55	–	euvd
NVD	CVE-2026-46453	6 Jul 202609:16	–	nvd
OSV	CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202607:55	–	osv
Positive Technologies	PT-2026-55888	6 Jul 202600:00	–	ptsecurity
Snyk	Authorization Bypass Through User-Controlled Key	6 Jul 202610:36	–	snyk
Vulnrichment	CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation	6 Jul 202607:55	–	vulnrichment

NVD

Vulners

Node

apache camelRange4.3.0–4.14.8

apache camelRange4.15.0–4.18.3

apache camelRange4.19.0–4.21.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-elasticsearch-rest-client",
    "product": "Apache Camel",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.14.8",
        "status": "affected",
        "version": "4.3.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.18.3",
        "status": "affected",
        "version": "4.15.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-46453.html
openwall	www.openwall.com/lists/oss-security/2026/07/05/6

Parameter	Position	Path	Description	CWE
OPERATION	header	platform-http:/products	Header injection enabling operation override to read/exfiltrate documents	CWE-20, CWE-639
SEARCH_QUERY	header	platform-http:/products	Header injection enabling operation override to read/exfiltrate documents	CWE-20, CWE-639
INDEX_NAME	header	platform-http:/products	Header injection enabling operation override to read/exfiltrate documents	CWE-20, CWE-639
INDEX_SETTINGS	header	platform-http:/products	Header injection enabling operation override to read/exfiltrate documents	CWE-20, CWE-639
ID	header	platform-http:/products	Header injection enabling operation override to read/exfiltrate documents	CWE-20, CWE-639

07 Jul 2026 23:30Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

EPSS0.00577

SSVC