CVE-2026-46587

camel-couchbase CCB 头部注入复现工具 CVE-2026-46587 本项目演示了 Apache Camel 的 camel-couchbase 组件中的一个消息头注入 漏洞，跟踪编号为 CVE-2026-46587 。该组件读取多个 Exchange 头来控制其行为 — CCBKEY（文档键）、CCBID（文档 ID）、CCBTTL（文档过期时间）、CCBDDN（设计文档名称）和 CCBVN（视图名称）。这些头常量的字符串值（定义在 CouchbaseConstants 中）是简单无前缀的名称，而非其他组件使用的 Camel 前缀名称（例如...

The vulnerability of the CouchDbProducer class in the camel-couchbase framework of the Apache Camel framework allows a attacker to gain access to read, modify, or delete data.

The vulnerability of the CouchDbProducer class in the camel-couchbase framework of the Apache Camel framework is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain read, modify, or delete access to data...

GHSA-46JF-C9VX-HH79 Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue...