CVE-2026-46453

camel-elasticsearch-rest-client Unprefixed-Header Injection Reproducer CVE-2026-46453 This project demonstrates a message-header injection / authorization bypass in Apache Camel's camel-elasticsearch-rest-client component, tracked as CVE-2026-46453. The component reads several Exchange headers to...

camel-elasticsearch-rest-client Security Bypass

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

CVE-2026-46453

A flaw was found in the camel-elasticsearch-rest-client component of Apache Camel. An untrusted HTTP client can exploit this vulnerability by sending specific, unprefixed Exchange headers directly on its request when a Camel route exposes an HTTP entry point. This improper input validation allows...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.15.0, <=4.18.2)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ElasticSearchRestClientConstant header names and ElasticsearchRestClientEndpointBuilderFactory producer headers. An attacker can override the Elasticsearch query, operation, index...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.8.0, <=3.27.4) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.3.0, <=4.14.7)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.3.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.3.0, =4.14.7 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.19.0, <=4.20.0)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892563...

org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.19.0, <=4.20.0)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46453 Source advisory: GHSA-RP9M-HFV5-PFVR...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.8.0, <=3.27.4) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.3.0, <=4.14.7)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.3.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.3.0, =4.14.7 Source cves: CVE-2026-46453 Source advisory: OSV:GHSA-RP9M-HFV5-PFVR...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.15.0, <=4.18.2)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46453 Source advisory: OSV:GHSA-RP9M-HFV5-PFVR...

org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.19.0, <=4.20.0)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46453 Source advisory: OSV:GHSA-RP9M-HFV5-PFVR...

Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

GHSA-RP9M-HFV5-PFVR Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.8.0, <=3.27.4) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.3.0, <=4.14.7)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.3.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.3.0, =4.14.7 Source cves: CVE-2026-46453 Source advisory: GHSA-RP9M-HFV5-PFVR...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.15.0, <=4.18.2)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46453 Source advisory: GHSA-RP9M-HFV5-PFVR...

CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

CVE-2026-46453 Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

EUVD-2026-41827

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCHQUERY an advanced query body, OPERATION which...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.7.0, <=4.14.7), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.8.0, <=3.27.4) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.3.0, <=4.14.7)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.3.0, =4.7.0, =3.8.0, =3.8.0, =3.8.0, =4.3.0, =4.14.7 Source cves: CVE-2026-46453 Source advisory: MEND:CVE-2026-46453...

org.apache.camel.karaf:camel-elasticsearch-rest-client (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-elasticsearch-rest-client (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-46453 via org.apache.camel:camel-elasticsearch-rest-client (>=4.15.0, <=4.18.2)

org.apache.camel:camel-elasticsearch-rest-client MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46453 Source advisory: MEND:CVE-2026-46453...