CVE-2026-49042 — camel-langchain4j-tools Prompt-Injection → Header-Injection

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: LangChain4jToolsProducer#invokeTools copies every field of the model's tool-call arguments JSON straight into Exchange headers, with no check against the declared parameter schema. The tool declares one parameter (host), but a prompt-injected model emits additional fields that land as Camel control headers and hijack whatever producer the tool route uses downstream (CWE-20).

No real LLM or API key is needed: the injection lives entirely in the tool-call arguments a mock model emits, exactly as a jailbroken or indirectly-prompt-injected model would produce.

Why the two variants hijack different sinks

The Spring Boot variant proves RCE through an exec: sink. That sink is not reachable by default on Camel 4.20.0 (what Camel Quarkus 3.36.0 bundles): CAMEL-23315 added an allowControlHeaders option to camel-exec, defaulting to false, first shipped in 4.20.0. That hardening is independent of this CVE and does not fix it — the injected fields still become Exchange headers at 4.20.0 (verified in the route log); only that one downstream sink stopped honouring its control headers. The Quarkus variant therefore hijacks the http producer, which is honoured by default, and additionally smuggles a Camel property placeholder that the producer resolves — yielding SSRF plus disclosure of a real application secret.

Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-49042.html

Disclaimer

These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.