Apache Camel leaks secrets via URI headers (CVE-2026-78164) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-78164 is a high-severity information disclosure flaw in Apache Camel 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 that lets an unauthenticated sender read environment variables, JVM system properties and vault secrets by setting the CamelHttpUri or CamelRestHttpUri header. Fixed in 4.23.0, 4.22.1 and 4.18.5.

Overview

The Camel HTTP producer families (camel-http, camel-http-common, camel-netty-http, camel-undertow and camel-vertx-http) allow an inbound message to override the outbound endpoint URI through the CamelHttpUri and CamelRestHttpUri headers. Before this fix, that message-supplied string was passed through CamelContext.resolvePropertyPlaceholders() before use. Placeholder resolution is a configuration facility: it reads OS environment variables, JVM system properties, any registered PropertiesFunction (including AWS, Azure, GCP, HashiCorp, IBM, CyberArk and Kubernetes secret resolvers) and, via camel-bean, invokes a no-argument method on any bean in the registry.

Applying it to Exchange content turned a simple URI string into a configuration- and bean-evaluation context. A route author needed to do nothing unusual: a plain static to("http://backend/api") was enough. Seven call sites were affected across the five components.

Impact

An attacker who can reach a Camel HTTP consumer can name configuration keys inside the URI header and observe the result. Where the resolved value appears in an outbound request or an error, secrets leak directly. Even without a response, an unresolvable placeholder produces a RuntimeExchangeException whose message echoes the URI, giving a reliable set-versus-unset oracle for any key. The bridgeEndpoint option does not help: it suppresses the CamelHttpUri override when building the URL but not when the header is reparsed for the query string, and CamelRestHttpUri is consumed before any bridgeEndpoint check. Several Camel HTTP consumers also populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature, so header injection is not always required.

Remediation

Upgrade to 4.23.0. On the 4.22.x stream, move to 4.22.1; on 4.18.x, move to 4.18.5. The 4.14.x stream and earlier are end-of-life and will not receive a fix, so those deployments must migrate to a supported release.

If you cannot upgrade immediately:

• Strip the override headers at the trust boundary with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri") before the producer.
• Set skipControlHeaders=true on camel-http endpoints. This is the only component with that option.
• Do not rely on bridgeEndpoint=true or on percent-encoding the placeholder delimiters; the latter fails for camel-netty-http, which decodes the request path before the value reaches the header.
• Apply a strict inbound HeaderFilterStrategy over the Camel namespace on any consumer exposed to untrusted senders.
• Resolve secrets through a vault rather than environment variables or system properties a placeholder can name.

This advisory extends the same build-time-resolution contract that CAMEL-24282 applied to the toD and enrich EIPs in 4.22.0.

Security Insight

This bug shares a shape with the Atlassian and WSO2 incidents we covered recently: a feature that is safe by design becomes dangerous when its input source changes from operator to attacker. Camel’s placeholder engine was never meant to parse Exchange data, and the persistence of the behaviour since camel-http4 shows how long a default can survive without being re-examined. The partial fixes matter too - bridgeEndpoint covering only one header path is the kind of incomplete mitigation that gives teams false confidence, so treat header stripping and header filtering as separate, independently verified controls.

Related reading: Atlassian CVE-2026-21589 exploited within 2 hours, WSO2 and Adobe Commerce bugs exploited, CISA KEV, and AhsayCBS bugs exploited for web shells.

Further Reading

• AhsayCBS bugs exploited for web shells, new fixes out
• Atlassian CVE-2026-21589 exploited within 2 hours
• WSO2 and Adobe Commerce bugs exploited, CISA KEV
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs