CVE-2026-49099 — Updated!
PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.
CVE-2026-49099 — camel-salesforce sObjectQuery Header Injection
Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.2.0 + camel-spring-boot 4.18.2 |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.36.0 + Camel Quarkus 3.36.0 (bundles Camel 4.20.0) |
Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect:
AbstractSalesforceProcessor.getParameter() resolves the sObjectQuery header (and its siblings apexUrl,
sObjectName, …) ahead of the endpoint's configured value. Those header names are bare, non-Camel-prefixed
strings and camel-salesforce ships no HeaderFilterStrategy, so the HTTP boundary filter (HttpHeaderFilterStrategy,
which strips only Camel*) lets an inbound HTTP header pass straight through and override the route's scoped SOQL —
a SOQL query override / broken access control (CWE-74 + CWE-639).
Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README — with a
recording stand-in salesforce component, so no Salesforce org, OAuth, or network is required. In short, for
either:
cd camel-spring-boot # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Vulnerability Summary
| Property | Value |
|---|---|
| Component | camel-salesforce |
| CWE | CWE-74 (Injection) / CWE-639 (Authorization Bypass Through User-Controlled Key) |
| Impact | An unauthenticated HTTP client overrides the route's scoped SOQL/SOSL/Apex parameters via unfiltered headers, reading or acting on data outside the intended scope with the integration user's permissions |
| Affected Versions | From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0 |
| Fixed Versions | 4.14.8, 4.18.3, 4.21.0 |
| JIRA | CAMEL-23716 (PR apache/camel#23887) |
| Credit | Yu Bao (PayPal) |
The fix renames the header constants to the CamelSalesforce* convention (e.g. CamelSalesforceSObjectQuery), so
they are stripped at the HTTP boundary like every other Camel* header.
Advisory: https://camel.apache.org/security/CVE-2026-49099.html
Disclaimer
These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.