camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure

🗓️ 30 Jul 2026 07:44:56Reported by RedHatType

Unauthenticated attacker can inject query parameters in Camel Vertx Websocket, causing server side request forgery and exposure of sensitive data.

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Apache Camel	16 Jul 202612:51	–	githubexploit
ATTACKERKB	CVE-2026-46726	6 Jul 202608:05	–	attackerkb
BDU FSTEC	The vulnerability of the `VertxWebsocketConsumer.populateExchangeHeaders()` function in the Vertx WebSocket component of the Java framework Apache Camel allows a attacker to disclose sensitive information and perform an SSRF attack.	17 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-46726	5 Jul 202620:03	–	circl
CVE	CVE-2026-46726	6 Jul 202608:05	–	cve
Cvelist	CVE-2026-46726 Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers	6 Jul 202608:05	–	cvelist
EUVD	EUVD-2026-41837	6 Jul 202608:05	–	euvd
NVD	CVE-2026-46726	6 Jul 202609:16	–	nvd
OSV	CVE-2026-46726 Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers	6 Jul 202608:05	–	osv
Positive Technologies	PT-2026-55898	6 Jul 202600:00	–	ptsecurity

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-46726
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
camel	www.camel.apache.org/security/CVE-2026-46726.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46726
cve	www.cve.org/CVERecord

30 Jul 2026 14:55Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.00783

SSVC