Apache Camel vulnerabilities
87 published vulnerabilities in Apache Camel. The most were published in 2026 (58), and 58 so far in 2026.
Apache Camel vulnerabilities by year
2013
2014
2015
2016
2017
2018
2019
2020
2023
2024
2025
2026
Most exploited Apache Camel vulnerabilities
- CVE-2026-33453 Apache camel-coap allows header injection that can lead to remote code execution
- CVE-2026-40453 Apache Camel has an incomplete fix for CVE-2025-27636
- CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
- CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
- CVE-2026-71300 Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
- CVE-2026-78329 Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
- CVE-2026-43867 Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
- CVE-2026-46454 Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
- CVE-2026-46455 Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
- CVE-2026-46456 Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
- CVE-2026-48204 Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
- CVE-2026-53913 Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.