CVE-2026-46592 — camel-cxf operationName Header Injection (SOAP Operation Redirection)

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: CxfProducer#getBindingOperationInfo first looks for an operationName message header and only falls back to the endpoint's defaultOperationName when it is absent. That header constant's value is the plain string operationName — not CamelCxfOperationName — so the HTTP boundary filter (which strips only Camel*) lets an inbound HTTP header of that name straight through. An untrusted client adds operationName: deleteAccount and the route's pinned, read-only getBalance becomes a destructive call (CWE-441, confused deputy).

The two variants differ only in how the backend SOAP service is stood up: the Quarkus variant publishes it with quarkus-cxf on the managed Quarkus HTTP server (so the contract carries JAX-WS @WebService annotations), while the Spring Boot variant creates it programmatically with a CXF ServerFactoryBean on a separate port. The defect is unaffected.

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-46592.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.