CVE-2026-49099 Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search,...

CVE-2026-49099

The CVE affects Apache Camel: Salesforce component, where operation parameters (SOQL/SOSL queries, SObject name/id, Apex URL/method, Apex query params) are read from untrusted Exchange headers, bypassing endpoint config due to plain non‑Camel header names. HttpHeaderFilterStrategy blocks only the...