Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-46592

CVE-2026-46592: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP…

    CVE-2026-46592Source published Source updated

    Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and…

    Affected products in this advisory
    • Apache Camel CXF
    Source-reported affected versions
    • 4.0.0 through 4.14.8
    • 4.15.0 through 4.18.3
    • 4.19.0 through 4.21.0.
    Source-reported fixed versions
    • 4.21.0
    • 4.14.8
    • 4.18.3
    Mitigation guidance
    • Users are recommended to upgrade to version 4.21.0, which fixes the issue.
    • If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8.
    • If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
    • After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern.

    1 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-46592] Remote attacker can execute unintended operations via header manipulation

    CVE-2026-46592Source published Source updated

    Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and…

    Affected products in this advisory
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
    • Red Hat build of Apache Camel 4 for Quarkus 3
    Source-reported affected versions
    • < 4.0.0
    • < 4.14.8
    • < 4.15.0
    • < 4.18.3

    2 more entries in the full advisory.

    Source-reported fixed versions
    • 4.21.0
    • 4.14
    • 4.14.8
    • 4.18

    4 more entries in the full advisory.

    Mitigation guidance
    • To mitigate this issue, ensure that the `operationName` and `operationNamespace` headers are not sourced from untrusted input when bridging an HTTP consumer to a `cxf:` producer in Apache Camel routes. Configure the route to explicitly strip these headers from any untrusted ingress before they reach the `cxf:` producer. Subsequently, set the intended SOAP operation from a trusted, internal source within the route. This prevents a remote attacker from manipulating backend service operations. Changes to route configurations may require a service restart to take effect.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features