Server-Side Request Forgery (SSRF)

🗓️ 12 Aug 2026 05:03:10Reported by Veracode Vulnerability DatabaseType

Apache Camel SSRF via unfiltered WebSocket query parameters allows disclosure of secrets.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for Server-Side Request Forgery in Apache Camel	22 Jul 202609:13	–	githubexploit
attackerkb	CVE-2026-55993	6 Jul 202608:13	–	attackerkb
BDU FSTEC	The vulnerability of the sendEventNotification() and getQueryMap() functions in the WebsocketConsumer class of the camel-atmosphere-websocket component of the Apache Camel framework allows a attacker to disclose protected information.	24 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-55993	5 Jul 202620:49	–	circl
CVE	CVE-2026-55993	6 Jul 202608:13	–	cve
Cvelist	CVE-2026-55993 Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour	6 Jul 202608:13	–	cvelist
EUVD	EUVD-2026-41849	6 Jul 202608:13	–	euvd
Github Security Blog	Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy	6 Jul 202609:30	–	github
Kitploit	CVE-2026-55993	4 Oct 202604:51	–	kitploit
Kitploit	CVE-2026-55994	3 Oct 202623:41	–	kitploit

Vulners

Node

Source	Link
github	www.github.com/apache/camel/pull/23285
openwall	www.openwall.com/lists/oss-security/2026/07/05/27
camel	www.camel.apache.org/security/CVE-2026-55993.html
github	www.github.com/apache/camel/commit/1e776238202edb9d98972cff558e12b53e499647
github	www.github.com/advisories/GHSA-rcvm-6r79-cf4r

29 Aug 2026 14:36Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.5

EPSS0.00857

SSVC