CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| WebSocket feed ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure

A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...

camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure

A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...

Vertx Websocket Component SSRF Information Disclosure

The vulnerability of the VertxWebsocketConsumer.populateExchangeHeaders method in the Vertx WebSocket component from the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to disclose sensitive information and...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Apache Camel

camel-vertx-websocket Header Injection Reproducer CVE-2026-46...

CVE-2026-46726

A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...

org.apache.camel.karaf:camel-vertx-websocket (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.0.0-m1, <=3.27.4) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-vertx-websocket MAVEN version =4.0.0-m1, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.14.7 Source cves: CVE-2026-46726 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17881055...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the VertxWebsocketConsumer inbound header mapping in components/camel-vertx/camel-vertx-websocket. An attacker can redirect server-side HTTP requests and disclose sensitive values by sending WebSocke...

org.apache.camel.karaf:camel-vertx-websocket (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-websocket MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46726 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17881055...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46726 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17881055...

org.apache.camel.karaf:camel-vertx-websocket (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.0.0-m1, <=3.27.4) +3 more potentially affected by CVE-2026-55993 via org.apache.camel:camel-vertx-websocket (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-vertx-websocket MAVEN version =4.0.0-m1, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.14.7 Source cves: CVE-2026-55993 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821203...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-55993 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55993 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821203...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the mapping of externally-supplied message user-headers into the Exchange without applying a header filtering process. An attacker can manipulate internal control headers by injecting specially craft...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-55994 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55994 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821200...

org.apache.camel.karaf:camel-vertx-websocket (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-55993 via org.apache.camel:camel-vertx-websocket (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-websocket MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-55993 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821203...

org.apache.camel.karaf:camel-vertx-websocket (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.31.0, <=3.33.1) +3 more potentially affected by CVE-2026-55994 via org.apache.camel:camel-vertx-websocket (>=4.17.0, <=4.18.2)

org.apache.camel:camel-vertx-websocket MAVEN version =4.17.0, =4.18.1, =3.31.0, =3.31.0, =3.31.0, =4.17.0, =4.18.2 Source cves: CVE-2026-55994 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821200...

org.apache.camel.karaf:camel-vertx-websocket (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.2.0, <=3.27.4) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.0.0, <=4.14.7)

org.apache.camel:camel-vertx-websocket MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46726 Source advisory: GHSA-HGG5-GP4C-GPCG...

org.apache.camel.karaf:camel-vertx-websocket (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.15.0, <=4.18.2)

org.apache.camel:camel-vertx-websocket MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46726 Source advisory: OSV:GHSA-HGG5-GP4C-GPCG...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46726 Source advisory: OSV:GHSA-HGG5-GP4C-GPCG...

org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-vertx-websocket (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46726 via org.apache.camel:camel-vertx-websocket (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-websocket MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46726 Source advisory: GHSA-HGG5-GP4C-GPCG...