CVE-2026-55994

🗓️ 06 Jul 2026 08:13:59Reported by apacheType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Apache Camel Iggy: inbound user-headers map to Exchange without filtering enables SSRF and secret exposure.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Server-Side Request Forgery in Apache Camel	22 Jul 202609:13	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in Apache Camel	22 Jul 202610:03	–	githubexploit
ATTACKERKB	CVE-2026-55994	6 Jul 202608:13	–	attackerkb
BDU FSTEC	The vulnerability of the `createExchange()` function in the IggyFetchRecords class of the camel-iggy component of the Apache Camel framework allows a attacker to disclose protected information.	24 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-55994	5 Jul 202620:54	–	circl
Cvelist	CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour	6 Jul 202608:13	–	cvelist
EUVD	EUVD-2026-41850	6 Jul 202608:13	–	euvd
NVD	CVE-2026-55994	6 Jul 202609:16	–	nvd
OSV	CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour	6 Jul 202608:13	–	osv
Positive Technologies	PT-2026-55910	6 Jul 202600:00	–	ptsecurity

NVD

Vulners

Node

apache camelRange4.17.0–4.18.3

apache camelRange4.19.0–4.21.0

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.camel:camel-iggy",
    "product": "Apache Camel Iggy",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.18.3",
        "status": "affected",
        "version": "4.17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.21.0",
        "status": "affected",
        "version": "4.19.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
camel	www.camel.apache.org/security/CVE-2026-55994.html
openwall	www.openwall.com/lists/oss-security/2026/07/05/28

Parameter	Position	Path	Description	CWE
CamelHttpUri	path	/legit-backend	Downstream HTTP producer target can be overridden via attacker-controlled CamelHttpUri header injected from Iggy/amplified headers	CWE-20, CWE-918, CWE-200
CamelHttpUri	path	/internal/secret	Attacker-controlled URI enables SSRF and exposure of secrets via property-placeholder resolution	CWE-20, CWE-918, CWE-200
CamelHttpUri	path	/collect	Attacker-controlled URI enables SSRF and secret disclosure via downstream HTTP producer when CamelHttpUri is injected	CWE-20, CWE-918, CWE-200

09 Jul 2026 03:03Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00621

SSVC

apache camel iggy header filtering inbound headers server side request forgery secret exposure