CVE-2026-46457 — camel-nats Inbound Header Injection (SSRF)

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: NatsConfiguration defaults headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules, so NatsConsumer copies every inbound NATS message header onto the Exchange — including CamelHttpUri. The camel-http producer honours that header as its request URI, so anyone who can publish to the consumed subject redirects the outbound request to a target of their choosing (SSRF, CWE-20). The same technique reaches any header-controlled producer (CamelFileName, CamelSqlQuery, ...).

Each subdirectory is a self-contained project (plus a NATS broker started by its docker-compose.yml) with its own Dockerfile and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-46457.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.