# Apache Camel


- [CVE-2026-33453](https://insights.sbomify.com/CVE-2026-33453/): Apache camel-coap allows header injection that can lead to remote code execution (critical 10.0)
- [CVE-2026-40453](https://insights.sbomify.com/CVE-2026-40453/): Apache Camel has an incomplete fix for CVE-2025-27636 (critical 9.9)
- [CVE-2026-80351](https://insights.sbomify.com/CVE-2026-80351/): Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod (critical 9.8)
- [CVE-2026-80352](https://insights.sbomify.com/CVE-2026-80352/): Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects (critical 9.8)
- [CVE-2026-71300](https://insights.sbomify.com/CVE-2026-71300/): Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection (critical 9.8)
- [CVE-2026-78329](https://insights.sbomify.com/CVE-2026-78329/): Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes (critical 9.8)
- [CVE-2026-43867](https://insights.sbomify.com/CVE-2026-43867/): Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (critical 9.8)
- [CVE-2026-46454](https://insights.sbomify.com/CVE-2026-46454/): Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers (critical 9.8)
- [CVE-2026-46455](https://insights.sbomify.com/CVE-2026-46455/): Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted (critical 9.8)
- [CVE-2026-46456](https://insights.sbomify.com/CVE-2026-46456/): Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (critical 9.8)
- [CVE-2026-48204](https://insights.sbomify.com/CVE-2026-48204/): Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers (critical 9.8)
- [CVE-2026-53913](https://insights.sbomify.com/CVE-2026-53913/): Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/camel/