CVE-2026-46726 — camel-vertx-websocket Header Injection (SSRF + Secret Disclosure)

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: VertxWebsocketConsumer#populateExchangeHeaders copies the WebSocket connection's query parameters onto the Exchange with no HeaderFilterStrategy. A client supplies CamelHttpUri as a query parameter and steers the downstream camel-http producer wherever it likes (SSRF, CWE-918). Because the producer also resolves Camel property placeholders on that attacker-controlled URI, an injected {{app.secret}} is expanded to its real value and sent to the attacker's collector (information exposure, CWE-200).

The two variants differ only in where the feed is served: the camel-quarkus-vertx-websocket extension always binds the consumer to the managed Quarkus HTTP server and rejects any other host/port, so the Quarkus variant serves /feed on :8080 alongside its REST endpoints. The defect is unaffected.

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-46726.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.