Loading vulnerability…
CVE-2026-46454 is an improper input validation vulnerability in Apache Camel's camel-cometd component. The CometdBinding.populateExchangeFromMessage method copies the complete client-supplied ext.CamelHeaders map into a Camel message without applying a HeaderFilterStrategy. Consequently, Bayeux clients can supply Camel-internal control headers that are accepted unmodified and retained across internal direct, seda, and vm route hops. These headers can alter the behavior of downstream route producers. Affected versions are Apache Camel 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained Java/Spring Boot reproducer for CVE-2026-46454 in Apache Camel's camel-cometd component. It is a real exploit/demo, not just documentation or detection logic. The project contains a minimal application entry point (Application.java), a vulnerable Camel route (VictimRoute.java), and an attacker controller (ExploitController.java). The route listens on cometd://0.0.0.0:8088/service/inject and forwards messages to exec:echo?args=hello. The exploit controller exposes GET /exploit/attack on port 8080; when invoked, it creates a CometD Bayeux client, performs an unauthenticated handshake to http://localhost:8088/cometd, and publishes to /service/inject while injecting ext.CamelHeaders containing CamelExecCommandExecutable=/usr/bin/touch and CamelExecCommandArgs=/tmp/pwned. Because affected camel-cometd versions copy client-supplied ext.CamelHeaders directly onto the Camel Exchange without a HeaderFilterStrategy, the downstream camel-exec producer honors the attacker-controlled headers and executes the injected command instead of the configured echo hello. The result is proof-of-execution via creation of /tmp/pwned. Repository support files include pom.xml defining vulnerable Camel 4.18.2 and CometD dependencies, application.properties setting server.port=8080, and Docker/Docker Compose files for containerized reproduction. Overall, the exploit demonstrates unauthenticated network-reachable header injection leading to downstream producer steering and, in this sample, command execution.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated network-accessible header-injection flaw in Apache Camel's camel-cometd component. Inbound CometD client messages can supply arbitrary Camel control headers, potentially influencing downstream HTTP, file, or JMS producers, including redirects, file-name changes, or JMS-destination overrides.
An improper input-validation vulnerability in Apache Camel's camel-cometd component. Unauthenticated CometD clients can inject arbitrary Camel control headers through ext.CamelHeaders, potentially influencing downstream HTTP, file, or JMS producers and persisting across internal Camel route hops.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.