Loading vulnerability…
CVE-2026-33454 is an important-severity vulnerability in the Apache Camel camel-mail component caused by incomplete header filtering in MailHeaderFilterStrategy. The strategy applies prefix-based filtering for outbound headers through setOutFilterStartsWith, but does not configure equivalent inbound filtering through setInFilterStartsWith. As a result, when a Camel route consumes email via camel-mail, including IMAP or POP3 consumers, Camel-prefixed MIME headers from inbound messages are accepted and mapped into the Camel Exchange without being filtered. An attacker who can send email to a mailbox monitored by a vulnerable Camel mail consumer can inject Camel-specific headers into the message flow. In deployments where downstream components interpret those headers, including components such as camel-bean, camel-exec, or camel-sql, the injected values can alter route behavior and may lead to remote code execution or other unsafe processing outcomes.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a working Java/Spring Boot reproducer for CVE-2026-33454, an Apache Camel camel-mail header injection vulnerability that can lead to remote code execution when mail-sourced messages are forwarded to header-sensitive producers. The project is not just documentation: it contains a runnable victim route and a helper attacker controller. Structure is small and focused: Application.java is the Spring Boot entry point; MailExecRoute.java defines the vulnerable Camel route that polls IMAP from 127.0.0.1:3143 using victim/secret and forwards messages to exec:echo?args=hello; ExploitController.java exposes HTTP endpoints on /exploit/normal and /exploit/attack that send email through local SMTP 127.0.0.1:3025 to victim@localhost, optionally adding CamelExecCommandExecutable and CamelExecCommandArgs MIME headers; docker-compose.yml launches GreenMail to provide SMTP/IMAP services; application.properties sets server.port=8080; pom.xml pins Camel 4.18.0, an affected version, and includes camel-mail and camel-exec starters. Main exploit capability: attacker-controlled email headers are injected into the Camel Exchange because inbound Camel* headers are not filtered by affected camel-mail versions, allowing the downstream camel-exec producer to honor attacker-supplied command/executable headers. The included payload is operational but basic: by default it causes /usr/bin/touch /tmp/pwned, though the executable and args can be customized via query parameters to the helper REST endpoint. Attack path is email-driven, with local network services used in the demo environment, and the exploit clearly demonstrates end-to-end command execution rather than mere detection.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of multiple Apache Camel vulnerabilities affecting SAP Integration Suite Edge Integration Cell.
One of multiple Apache Camel vulnerabilities affecting SAP Integration Suite Edge Integration Cell.
One of multiple Apache Camel vulnerabilities in SAP Integration Suite Edge Integration Cell affecting message-based header injection and/or deserialization mechanisms.
A header injection vulnerability in Apache Camel Mail that can alter application behavior.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.