USN-8506-1: Request Tracker vulnerabilities

Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. CVE-2026-6841 It was discovered that Request Tracker did not properly sanitize user-...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ElasticSearchRestClientConstant header names and ElasticsearchRestClientEndpointBuilderFactory producer headers. An attacker can override the Elasticsearch query, operation, index...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.15.0, <=4.18.2)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.8.0, <=3.27.4) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.3.0, <=4.14.7)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.3.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.3.0, =4.14.7 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.19.0, <=4.20.0)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the operationName and operationNamespace headers, which are not properly filtered by the HTTP header filter. An attacker can cause the backend SOAP servi...

org.apache.camel.springboot:camel-cxf-rest-starter (>=4.19.0, <=4.20.0), org.apache.camel:camel-cxf-spring-rest (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-rest MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-cxf (4.18.0) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-rest MAVEN version =4.15.0, =4.18.1, =4.18.1, =4.18.1, =4.18.1, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

org.apache.camel.springboot:camel-cxf-rest-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...

org.apache.camel.karaf:camel-cxf-spring-all (>=4.7.0, <=4.14.7), org.apache.camel.springboot:camel-cxf-rest-starter (>=4.0.0, <=4.14.7) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.0.0, =4.7.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...

org.apache.camel.karaf:camel-cxf-spring-all (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-cxf-rest-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-spring-rest (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-spring-rest MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879246...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the improper handling of HTTP headers in the process. An attacker can manipulate internal Salesforce operation parameters, such as SOQL...

Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false,...

Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search,...

GHSA-GCC7-C8MP-34QX Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search,...

org.apache.camel.springboot:camel-cxf-rest-starter (>=4.19.0, <=4.20.0), org.apache.camel:camel-cxf-spring-rest (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.19.0, <=4.20.0)

org.apache.camel:camel-cxf-rest MAVEN version =4.19.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46592 Source advisory: GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-cxf (4.18.0) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-rest MAVEN version =4.15.0, =4.18.1, =4.18.1, =4.18.1, =4.18.1, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: OSV:GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-cxf (4.18.0) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.15.0, <=4.18.2)

org.apache.camel:camel-cxf-rest MAVEN version =4.15.0, =4.18.1, =4.18.1, =4.18.1, =4.18.1, =4.15.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46592 Source advisory: GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: OSV:GHSA-MRRP-9GJM-749V...