CVE-2026-49086

The Apache Camel camel-dapr component is vulnerable to a confused deputy flaw (CWE-441 ) due to improper input validation. The DaprPubSubConsumer incorrectly copies the pubsubName and topic fields from untrusted inbound CloudEvents into the CamelDaprPubSubName and CamelDaprTopic Exchange headers....

PT-2026-55903

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer DaprPubSubConsumer copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the...