CVE-2026-49098 — Updated!
PoC reproducer for CVE-2026-49098 (Apache Camel camel-kafka): the non-Camel-prefixed kafka.OVERRIDE_TOPIC header escapes the upstream HTTP header filter and overrides the producer's configured topic, injecting an attacker-forged record onto a privileged Kafka topic (cross-topic injection). Fixed in 4.14.8/4.18.3/4.21.0.
CVE-2026-49098 — camel-kafka kafka.OVERRIDE_TOPIC Header Injection
Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.2.0 + camel-spring-boot 4.18.2 |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.36.0 + Camel Quarkus 3.36.0 (bundles Camel 4.20.0) |
Both are affected versions (the issue is fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical
defect: KafkaProducer.evaluateTopic() reads the non-Camel-prefixed kafka.OVERRIDE_TOPIC header and prefers it
over the endpoint's configured topic. It escapes the HTTP header filter (Spring Boot's servlet platform-http and
Quarkus's Vert.x platform-http alike) and moves a produced record onto an attacker-chosen topic — cross-topic
injection (CWE-20 → CWE-74).
Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README with
full details and reproduction steps. In short, for either:
cd camel-spring-boot # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Vulnerability Summary
| Property | Value |
|---|---|
| Component | camel-kafka (Spring Boot: camel-kafka-starter; Quarkus: camel-quarkus-kafka) |
| CWE | CWE-20 (Improper Input Validation) / CWE-74 (Injection) |
| Impact | Redirect / inject a produced record onto an arbitrary Kafka topic |
| Affected Versions | From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0 |
| Fixed Versions | 4.14.8, 4.18.3, 4.21.0 |
| JIRA | CAMEL-23584 (PR apache/camel#23602) |
| Credit | Yu Bao (PayPal) |
Advisory: https://camel.apache.org/security/CVE-2026-49098.html
Disclaimer
These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.