CVE-2026-49098 Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic

🗓️ 06 Jul 2026 08:10:43Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Header filtering flaw lets HTTP clients override Kafka topic via kafka.OVERRIDE_TOPIC when bridging to Kafka.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-49098	6 Jul 202608:10	–	attackerkb
Circl	CVE-2026-49098	5 Jul 202620:34	–	circl
CVE	CVE-2026-49098	6 Jul 202608:10	–	cve
Cvelist	CVE-2026-49098 Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic	6 Jul 202608:10	–	cvelist
EUVD	EUVD-2026-41844	6 Jul 202608:10	–	euvd
NVD	CVE-2026-49098	6 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55905	6 Jul 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-49098	8 Jul 202606:40	–	redhatcve
Snyk	Improperly Controlled Modification of Dynamically-Determined Object Attributes	6 Jul 202610:35	–	snyk
Vulnrichment	CVE-2026-49098 Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic	6 Jul 202608:10	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/05/23
repo	www.repo.maven.apache.org/maven2
camel	www.camel.apache.org/security/CVE-2026-49098.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49098.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-49098

15 Jul 2026 01:49Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.15.3

EPSS0.00385