High [CVE-2026-46584] Credential exposure and information disclosure via improper input validation of mail headers
This high-severity Red Hat Linux advisory covers CVE-2026-46584 affecting Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Apache Camel 4 for Quarkus 3.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component.
The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smtps. namespace and, when any were present, built a per-message JavaMail sender with those values applied as JavaMail session properties, overriding the endpoint configuration.
This namespace is Camel-internal - only MailProducer interprets it - and was not blocked by any HeaderFilterStrategy, so the values could originate from any inbound protocol (for example platform-http query parameters or request headers, or JMS / Kafka messages from untrusted producers) that feeds a route ending in an smtp / smtps producer without an intervening removeHeaders.
Affected products named by the advisory: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16; Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Red Hat build of Apache Camel 4 for Quarkus 3.
- < 4.19.0
- < 4.0.0
- < 4.14.8
- < 4.15.0
- < 4.18.3
- < 4.21.0
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
- 4.21.0
- 4.14
- 4.14.8
- 4.18
- 4.18.3
- camel-mail
- RHSA-2026:54622
- RHSA-2026:48118
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, ensure that any Camel routes processing untrusted input and forwarding it to the mail producer explicitly strip the `mail.smtp.*` and `mail.smtps.*` header namespaces. This can be achieved by adding `removeHeaders('mail.smtp.*')` and `removeHeaders('mail.smtps.*')` to the route definition between the untrusted ingress and the SMTP/SMTPS producer.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.