CVE-2026-55994

camel-iggy User-Header Injection Reproducer CVE-2026-55994 This project demonstrates a message-header injection in Apache Camel's camel-iggy component, tracked as CVE-2026-55994. The Iggy consumer copies an inbound message's user-headers onto the Camel Exchange without anyHeaderFilterStrategy, so...

IggyFetchRecords Component Disclosure

The vulnerability of the createExchange function in the IggyFetchRecords class of the camel-iggy component of the Apache Camel framework is related to insufficient validation of input data when processing user-defined message headers. Exploiting this vulnerability could allow an attacker to...

Exploit for Server-Side Request Forgery in Apache Camel

camel-iggy User-Header Injection Reproducer CVE-2026-55994...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebsocketConsumer.service process. An attacker can redirect server-side HTTP requests to arbitrary destinations and access sensitive environment variables, application properties, or vault secret...

org.apache.camel.karaf:camel-iggy (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-iggy-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-55993 via org.apache.camel:camel-iggy (>=4.17.0, <=4.18.2)

org.apache.camel:camel-iggy MAVEN version =4.17.0, =4.18.1, =4.17.0, =4.18.2 Source cves: CVE-2026-55993 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821202...

org.apache.camel.springboot:camel-iggy-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.19.0, <=4.20.0)

org.apache.camel:camel-iggy MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55994 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821198...

org.apache.camel.springboot:camel-iggy-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-55993 via org.apache.camel:camel-iggy (>=4.19.0, <=4.20.0)

org.apache.camel:camel-iggy MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55993 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821202...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the mapping of externally-supplied message user-headers into the Exchange without applying a header filtering process. An attacker can manipulate internal control headers by injecting specially craft...

org.apache.camel.karaf:camel-iggy (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-iggy-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.17.0, <=4.18.2)

org.apache.camel:camel-iggy MAVEN version =4.17.0, =4.18.1, =4.17.0, =4.18.2 Source cves: CVE-2026-55994 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17821198...

org.apache.camel.springboot:camel-iggy-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.19.0, <=4.20.0)

org.apache.camel:camel-iggy MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55994 Source advisory: GHSA-PW9Q-PQ7C-RFQW...

org.apache.camel.springboot:camel-iggy-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.19.0, <=4.20.0)

org.apache.camel:camel-iggy MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55994 Source advisory: OSV:GHSA-PW9Q-PQ7C-RFQW...

GHSA-PW9Q-PQ7C-RFQW Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

org.apache.camel.karaf:camel-iggy (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-iggy-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.17.0, <=4.18.2)

org.apache.camel:camel-iggy MAVEN version =4.17.0, =4.18.1, =4.17.0, =4.18.2 Source cves: CVE-2026-55994 Source advisory: GHSA-PW9Q-PQ7C-RFQW...

org.apache.camel.karaf:camel-iggy (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-iggy-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.17.0, <=4.18.2)

org.apache.camel:camel-iggy MAVEN version =4.17.0, =4.18.1, =4.17.0, =4.18.2 Source cves: CVE-2026-55994 Source advisory: OSV:GHSA-PW9Q-PQ7C-RFQW...

org.apache.camel.springboot:camel-iggy-starter (>=4.19.0, <=4.20.0) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.19.0, <=4.20.0)

org.apache.camel:camel-iggy MAVEN version =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-55994 Source advisory: MEND:CVE-2026-55994...

EUVD-2026-41850

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

org.apache.camel.karaf:camel-iggy (>=4.18.1, <=4.18.2), org.apache.camel.springboot:camel-iggy-starter (>=4.17.0, <=4.18.2) potentially affected by CVE-2026-55994 via org.apache.camel:camel-iggy (>=4.17.0, <=4.18.2)

org.apache.camel:camel-iggy MAVEN version =4.17.0, =4.18.1, =4.17.0, =4.18.2 Source cves: CVE-2026-55994 Source advisory: MEND:CVE-2026-55994...