CVE-2026-55994

🗓️ 06 Jul 2026 08:13:59Reported by apacheType

cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

Apache Camel Iggy: inbound user-headers map to Exchange without filtering enables SSRF and secret exposure.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Server-Side Request Forgery in Apache Camel	22 Jul 202609:13	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in Apache Camel	22 Jul 202610:03	–	githubexploit
attackerkb	CVE-2026-55994	6 Jul 202608:13	–	attackerkb
BDU FSTEC	The vulnerability of the `createExchange()` function in the IggyFetchRecords class of the camel-iggy component of the Apache Camel framework allows a attacker to disclose protected information.	24 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-55994	5 Jul 202620:54	–	circl
Cvelist	CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour	6 Jul 202608:13	–	cvelist
EUVD	EUVD-2026-41850	6 Jul 202608:13	–	euvd
Github Security Blog	Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy	6 Jul 202609:30	–	github
Kitploit	CVE-2026-55994	19 Sep 202623:40	–	kitploit
NVD	CVE-2026-55994	6 Jul 202609:16	–	nvd

NVD

Vulners

Node

apache camelRange4.17.0–4.18.3

apache camelRange4.19.0–4.21.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-iggy",
    "product": "Apache Camel Iggy",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.18.3",
        "status": "affected",
        "version": "4.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-55994.html
openwall	www.openwall.com/lists/oss-security/2026/07/05/28

Parameter	Position	Path	Description	CWE
CamelHttpUri	header	/legit-backend	Iggy consumer copies attacker-controlled user-headers into the Exchange; injecting CamelHttpUri can override the downstream HTTP producer's target URI, enabling SSRF and secret disclosure via placeholder resolution.	CWE-20, CWE-918, CWE-200
CamelHttpUri	header	/internal/secret	Attacker-controlled CamelHttpUri can redirect to /internal/secret, enabling SSRF against internal resources and leakage of secrets.	CWE-20, CWE-918, CWE-200
CamelHttpUri	header	/collect	Injecting CamelHttpUri to point to /collect enables SSRF and potential secret leakage via placeholder resolution.	CWE-20, CWE-918, CWE-200
CamelHttpUri	header	/collect/{secret}	Target path /collect/{secret} can be abused via CamelHttpUri header injection for SSRF and secret disclosure.	CWE-20, CWE-918, CWE-200

09 Jul 2026 03:03Current

6Medium risk

Vulners AI Score6

EPSS0.00625

SSVC

apache camel iggy header filtering inbound headers server side request forgery secret exposure