Loading vulnerability…
CVE-2026-46726 is an improper input-validation vulnerability in Apache Camel's camel-vertx-websocket component. VertxWebsocketConsumer.populateExchangeHeaders() mapped WebSocket query and path parameters into the Camel Exchange header map without applying a HeaderFilterStrategy. An external client could therefore inject Camel internal control headers, including CamelHttpUri (Exchange.HTTP_URI), through WebSocket parameters. If the consumer route passes the Exchange to a downstream HTTP producer, the injected URI can override the intended HTTP destination. The HTTP producer can also resolve Camel property placeholders in the attacker-controlled URI, exposing resolved environment variables, application properties, or vault-backed secrets. Affected versions are Apache Camel 4.0.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.x.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained Java/Spring Boot proof-of-concept reproducer for CVE-2026-46726 in Apache Camel's camel-vertx-websocket component. It is a real exploit, not merely a detector: it stands up a vulnerable Camel route, local sink endpoints, and an attacker workflow that automatically triggers exploitation. Repository structure is small and focused. Application.java is the Spring Boot entry point. VictimRoute.java defines the vulnerable integration flow: from("vertx-websocket:0.0.0.0:8090/feed") to("http://localhost:8080/legit-backend?throwExceptionOnFailure=false"). SinkController.java exposes three HTTP endpoints on port 8080 to observe routing behavior: /legit-backend, /internal/secret, and /collect. ExploitController.java is the main exploit logic; it opens a WebSocket connection to ws://localhost:8090/feed and optionally appends a CamelHttpUri query parameter, which the vulnerable consumer maps into Camel headers. application.properties sets server.port=8080 and defines app.secret=SUPER-SECRET-abc123 for the disclosure demonstration. Dockerfile and docker-compose.yml package the reproducer into a single containerized service. Main exploit capability: unauthenticated WebSocket clients can inject Camel internal control headers through query parameters, specifically CamelHttpUri. Because the downstream camel-http producer honors Exchange.HTTP_URI when bridgeEndpoint is false, the attacker can redirect server-side HTTP requests to arbitrary destinations. The PoC demonstrates two concrete impacts: (1) SSRF by forcing the route to request http://localhost:8080/internal/secret instead of the intended /legit-backend, and (2) secret disclosure by injecting http://localhost:8080/collect?leak={{app.secret}}, causing Camel to resolve the placeholder and send the real secret value to the collector endpoint. The exploit is operational but basic: payloads are hardcoded into the controller and intended for demonstration. It does not provide a generalized framework or customizable operator tooling, so OPERATIONAL is the best fit rather than WEAPONIZED. The attack vector is primarily web/network via a WebSocket connection to the exposed consumer endpoint. The most important fingerprintable observables are the WebSocket listener on 0.0.0.0:8090/feed, the downstream HTTP target http://localhost:8080/legit-backend, the exploit trigger /exploit/attack, and the SSRF/disclosure destinations /internal/secret and /collect.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An SSRF and sensitive-data-exposure vulnerability in Apache Camel Vertx Websocket.
An Apache Camel Vertx Websocket vulnerability enabling server-side request forgery and sensitive-data exposure.
An improper-input-validation flaw in Apache Camel's Vertx WebSocket component that permits externally supplied WebSocket parameters to inject Camel control headers. In routes that pass the consumer to an HTTP producer, an unauthenticated attacker may cause SSRF via CamelHttpUri and potentially exfiltrate secrets through property-placeholder resolution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.