Apache Camel HTTP Header Placeholder Flaw Can Expose Application Configuration

Apache Camel disclosed CVE-2026-78164, a vulnerability in HTTP producer handling that can expose application configuration values through message-supplied endpoint override headers. Tracked as CAMEL-24418, the flaw causes property placeholders in CamelHttpUri and CamelRestHttpUri headers to be expanded against application property sources during URL construction and query-string extraction. Affected paths span camel-http, camel-http-common, camel-vertx-http, camel-undertow, and camel-netty-http. Setting bridgeEndpoint=true does not fully prevent the behavior, because some paths process these headers before or outside the relevant checks. The supplied reports do not establish active exploitation.

Apache removed per-message placeholder resolution from affected paths, making placeholder tokens supplied only through these headers literal URI text while preserving documented build-time resolution in route endpoint URIs. The fix was merged into the main branch and backported to camel-4.22.x and camel-4.18.x, with an additional affected path removed from camel-4.18.x. Releases before 4.15.0 are also affected but will not receive fixes because those release lines are end of life. Organizations should identify routes where untrusted messages can influence endpoint override headers, restrict that input, and move to a supported release containing the fix; the supplied references do not identify exact fixed release numbers.