CVE-2026-46585

camel-lucene QUERY Header Injection Reproducer CVE-2026-46585 This project demonstrates a message-header injection / authorization bypass in Apache Camel's camel-lucene component, tracked as CVE-2026-46585. The Lucene query producer reads the full-text search phrase from an Exchange header, but t...

Authorization Bypass

Apache Camel Lucene Component is vulnerable to Authorization Bypass. The vulnerability is due to the camel-lucene producer accepting the QUERY and RETURNLUCENEDOCS headers from inbound HTTP requests because HttpHeaderFilterStrategy only blocks the Camel-prefixed header namespace, where an attacke...

Exploit for Improper Input Validation in Apache Camel

camel-lucene QUERY Header Injection Reproducer CVE-2026-465...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the LuceneConstants.HEADERQUERY and LuceneConstants.HEADERRETURNLUCENEDOCS headers in the Lucene producer. An attacker can override the intended Lucene search by sending an HTTP...

org.apache.camel.quarkus:camel-quarkus-lucene (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-lucene-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.19.0, <=4.20.0)

org.apache.camel:camel-lucene MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46585 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892032...

org.apache.camel.karaf:camel-lucene (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-lucene (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.15.0, <=4.18.2)

org.apache.camel:camel-lucene MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46585 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892032...

org.apache.camel.karaf:camel-lucene (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-lucene (>=3.2.0, <=3.13.0) +3 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.0.0, <=4.14.7)

org.apache.camel:camel-lucene MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46585 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892032...

org.apache.camel.quarkus:camel-quarkus-lucene (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-lucene-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.19.0, <=4.20.0)

org.apache.camel:camel-lucene MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46585 Source advisory: GHSA-566H-V38H-3XP3...

org.apache.camel.quarkus:camel-quarkus-lucene (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-lucene-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.19.0, <=4.20.0)

org.apache.camel:camel-lucene MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46585 Source advisory: OSV:GHSA-566H-V38H-3XP3...

org.apache.camel.karaf:camel-lucene (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-lucene (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.15.0, <=4.18.2)

org.apache.camel:camel-lucene MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46585 Source advisory: GHSA-566H-V38H-3XP3...

org.apache.camel.karaf:camel-lucene (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-lucene (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.15.0, <=4.18.2)

org.apache.camel:camel-lucene MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46585 Source advisory: OSV:GHSA-566H-V38H-3XP3...

org.apache.camel.karaf:camel-lucene (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-lucene (>=3.2.0, <=3.13.0) +3 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.0.0, <=4.14.7)

org.apache.camel:camel-lucene MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46585 Source advisory: GHSA-566H-V38H-3XP3...

org.apache.camel.karaf:camel-lucene (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-integration-test-lucene (>=3.2.0, <=3.13.0) +3 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.0.0, <=4.14.7)

org.apache.camel:camel-lucene MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46585 Source advisory: OSV:GHSA-566H-V38H-3XP3...

GHSA-566H-V38H-3XP3 Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header LuceneConstants.HEADERQUERY whose value was the plain string QUERY and RETURNLUCENEDOCS for...

Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header LuceneConstants.HEADERQUERY whose value was the plain string QUERY and RETURNLUCENEDOCS for...

CVE-2026-46585 Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header LuceneConstants.HEADERQUERY whose value was the plain string QUERY and RETURNLUCENEDOCS for...

CVE-2026-46585 Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header LuceneConstants.HEADERQUERY whose value was the plain string QUERY and RETURNLUCENEDOCS for...

org.apache.camel.quarkus:camel-quarkus-lucene (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-lucene-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.19.0, <=4.20.0)

org.apache.camel:camel-lucene MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46585 Source advisory: MEND:CVE-2026-46585...

CVE-2026-46585

The Apache Camel Lucene Component is vulnerable to an authorization bypass via improper input validation in versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0. The root cause is that the producer reads search phrases from the QUERY and RETURN_LUCENE_DOCS headers. Because...

org.apache.camel.karaf:camel-lucene (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-lucene (>=3.29.0, <=3.33.1) +2 more potentially affected by CVE-2026-46585 via org.apache.camel:camel-lucene (>=4.15.0, <=4.18.2)

org.apache.camel:camel-lucene MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46585 Source advisory: MEND:CVE-2026-46585...