CVE-2026-55994

High [CVE-2026-55994] Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…

CVE-2026-55994Source published Jul 6, 2026Source updated Jul 9, 2026

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange). Because nothing blocked the Camel header namespace, an actor able to publish to the consumed Iggy stream/topic could set Camel-internal control headers - including CamelHttpUri (Exchange.HTTP_URI) - simply by supplying them as message user-headers. In a route where the Iggy consumer feeds a downstream HTTP producer, the injected CamelHttpUri redirects the server-side HTTP request to an…

Affected products in this advisory

• Apache Camel

Source-reported affected versions

• 4.17.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.

Workarounds

• For deployments that cannot upgrade immediately, strip the Camel control headers from the inbound message before they reach any downstream producer (for example removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route), restrict who can publish to the consumed Iggy stream/topic, and avoid bridging an untrusted consumer directly into an HTTP producer whose target URI can be driven from message headers.