CVE-2026-78164

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to("http://backend/api") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a set from an unset configuration key even where no outbound request is made. The behaviour predates the 4.x line. This advisory continues the alignment CAMEL-24282 applied to the toD and enrich dynamic-URI EIPs in 4.22.0, extending the same build-time-resolution contract to the HTTP producer components. Users should upgrade to version 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, strip the override headers at the trust boundary before the producer with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri"), or set skipControlHeaders=true on camel-http endpoints, which is the only component offering that option. Note that bridgeEndpoint=true is not a workaround: it suppresses the header override when the outbound URL is built but not when the header is re-parsed for the query string. Percent-encoding the placeholder delimiters is likewise not a mitigation for camel-netty-http, whose binding decodes the request path before the value reaches the header, so proxy or WAF rules written against the raw delimiters do not help there. As defence in depth, ensure consumers exposed to untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel namespace, and resolve secrets through a vault rather than through environment variables or system properties that a placeholder can name.

• CWE-200
• CWE-1336

• https://camel.apache.org/security/CVE-2026-78164.html
• https://github.com/apache/camel/commit/7cec534c66969015d85e56631143174dd150ed94
• https://github.com/apache/camel/commit/9f8a185e315ce9e120889c4106be3dbf4688e507
• https://github.com/apache/camel/commit/ba5aced7f6a1c38a963020575676ad4c76b492cf
• https://github.com/apache/camel/pull/25571
• https://issues.apache.org/jira/browse/CAMEL-24418

Published

Oct 19, 2026

Last Modified

Oct 19, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78159The The Events Calendar plugin for WordPress is vulnerable t…9.8
• CVE-2026-7816OS command injection (CWE-78) vulnerability in pgAdmin 4 Imp…8.8
• CVE-2026-78160A vulnerability has been found in Dolibarr ERP up to 18.0.10…6.3
• CVE-2026-78161A vulnerability was found in warmcat libwebsockets 4.5.0. Im…7.3
• CVE-2026-78162Deserialization of Untrusted Data vulnerability in Apache Ca…10
• CVE-2026-78163Server-Side Request Forgery (SSRF), Improper Limitation of a…5.9
• CVE-2026-78165Deserialization of Untrusted Data vulnerability in Apache Ca…8.8
• CVE-2026-78166A security flaw has been discovered in provectus kafka-ui up…6.3
• CVE-2026-78167A weakness has been identified in EFM ipTIME T16000M 14.20.2…10
• CVE-2026-78168A security vulnerability has been detected in EFM ipTIME T24…9.8
• CVE-2026-78169A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…9.9
• CVE-2026-7817Local file inclusion (LFI) and server-side request forgery (…7.1