CVE-2026-49086

camel-dapr Consumer Routing-Header Override / Confused Deputy Reproducer CVE-2026-49086 This project demonstrates a routing-header override confused-deputy flaw in Apache Camel's camel-dapr component, tracked as CVE-2026-49086. The Dapr pub/sub consumer DaprPubSubConsumer copies fields of the...

DaprPubSubConsumer Apache Camel Class Data Compromise

The vulnerability of the DaprPubSubConsumer class in the camel-dapr framework of the Apache Camel framework is related to the possibility of bypassing access control mechanisms. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the DaprPubSubConsumer process. An attacker can redirect or exfiltrate messages and bypass intended routing and topic-level access controls by publishing specially crafted CloudEvents with manipulated...

org.apache.camel.karaf:camel-dapr (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-dapr-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dapr MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-49086 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822556...

org.apache.camel.springboot:camel-dapr-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dapr MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49086 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822556...

org.apache.camel.karaf:camel-dapr (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-dapr-starter (>=4.12.0, <=4.14.7) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.12.0, <=4.14.7)

org.apache.camel:camel-dapr MAVEN version =4.12.0, =4.14.5, =4.12.0, =4.14.7 Source cves: CVE-2026-49086 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822556...

org.apache.camel.karaf:camel-dapr (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-dapr-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dapr MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-49086 Source advisory: OSV:GHSA-583R-F84W-33G7...

org.apache.camel.springboot:camel-dapr-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dapr MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49086 Source advisory: GHSA-583R-F84W-33G7...

org.apache.camel.karaf:camel-dapr (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-dapr-starter (>=4.12.0, <=4.14.7) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.12.0, <=4.14.7)

org.apache.camel:camel-dapr MAVEN version =4.12.0, =4.14.5, =4.12.0, =4.14.7 Source cves: CVE-2026-49086 Source advisory: GHSA-583R-F84W-33G7...

org.apache.camel.karaf:camel-dapr (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-dapr-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dapr MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-49086 Source advisory: GHSA-583R-F84W-33G7...

org.apache.camel.karaf:camel-dapr (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-dapr-starter (>=4.12.0, <=4.14.7) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.12.0, <=4.14.7)

org.apache.camel:camel-dapr MAVEN version =4.12.0, =4.14.5, =4.12.0, =4.14.7 Source cves: CVE-2026-49086 Source advisory: OSV:GHSA-583R-F84W-33G7...

GHSA-583R-F84W-33G7 Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer DaprPubSubConsumer copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the...

org.apache.camel.springboot:camel-dapr-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dapr MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49086 Source advisory: OSV:GHSA-583R-F84W-33G7...

org.apache.camel.karaf:camel-dapr (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-dapr-starter (>=4.15.0, <=4.18.2) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.15.0, <=4.18.2)

org.apache.camel:camel-dapr MAVEN version =4.15.0, =4.18.1, =4.15.0, =4.18.2 Source cves: CVE-2026-49086 Source advisory: MEND:CVE-2026-49086...

org.apache.camel.springboot:camel-dapr-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.19.0, <=4.20.0)

org.apache.camel:camel-dapr MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49086 Source advisory: MEND:CVE-2026-49086...

org.apache.camel.karaf:camel-dapr (>=4.14.5, <=4.14.7), org.apache.camel.springboot:camel-dapr-starter (>=4.12.0, <=4.14.7) potentially affected by CVE-2026-49086 via org.apache.camel:camel-dapr (>=4.12.0, <=4.14.7)

org.apache.camel:camel-dapr MAVEN version =4.12.0, =4.14.5, =4.12.0, =4.14.7 Source cves: CVE-2026-49086 Source advisory: MEND:CVE-2026-49086...

CVE-2026-49086

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer DaprPubSubConsumer copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the...