CVE-2026-48206 — camel-jira IssueKey Header Injection

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: the camel-jira producers read their operation parameters (issue key, project key, transition id, …) from Exchange message headers whose constants — IssueKey, ProjectKey, IssueTransitionId, … — are bare, non-Camel-prefixed strings. The HTTP boundary filter (HttpHeaderFilterStrategy) strips only Camel*, so an inbound HTTP header of that name passes straight into the Exchange and overrides what the route acts on. An unauthenticated client injects IssueKey: PROD-999 and the route's service account deletes an arbitrary issue (CWE-639).

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

The fix renames the header constants to the CamelJira* convention (e.g. CamelJiraIssueKey), so they are stripped at the HTTP boundary like every other Camel* header.

Advisory: https://camel.apache.org/security/CVE-2026-48206.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.