CVE-2026-48206

{
  "id": "CVE-2026-48206",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T09:16:38.000",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component.\n\nThe camel-jira producers read their operation parameters - the issue key, project key, transition id, summary, type, assignee, components, watchers, link type, work-log minutes and others - from Exchange message headers. The header constants defined in JiraConstants (for example ISSUE_KEY = IssueKey, ISSUE_PROJECT_KEY = ProjectKey, ISSUE_TRANSITION_ID = IssueTransitionId, LINK_TYPE = linkType) used plain, non-Camel-prefixed values. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a jira: producer, any HTTP client could therefore supply these headers and override the values the route intended, driving JIRA operations against the configured JIRA instance with the endpoint's configured service-account credentials - for example deleting or transitioning an arbitrary issue (via IssueKey / IssueTransitionId), creating an issue in a different project (via ProjectKey), modifying issue fields, adding or removing watchers, or logging work. The operations are bounded by what the configured service account is permitted to do. No credentials are required from the attacker when the bridging consumer is unauthenticated.\nThis issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.\n\nUsers are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive JIRA operations via the raw header names must use the CamelJira* names (for example CamelJiraIssueKey) instead of the old values. For deployments that cannot upgrade immediately, strip the camel-jira control headers from any untrusted ingress before the jira: producer (for example removing the IssueKey, ProjectKey, IssueTransitionId and related headers at the start of the route), and set the required JIRA operation parameters from a trusted source."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de validación de entrada incorrecta y omisión de autorización a través de clave controlada por el usuario en el componente JIRA de Apache Camel.\n\nLos productores de camel-jira leen sus parámetros de operación - la clave de la incidencia, clave del proyecto, ID de transición, resumen, tipo, asignado, componentes, observadores, tipo de enlace, minutos de registro de trabajo y otros - de los encabezados de mensajes de Exchange. Las constantes de encabezado definidas en JiraConstants (por ejemplo, ISSUE_KEY = IssueKey, ISSUE_PROJECT_KEY = ProjectKey, ISSUE_TRANSITION_ID = IssueTransitionId, LINK_TYPE = linkType) utilizaban valores simples, sin prefijo Camel. Debido a que estos nombres no comienzan con el prefijo Camel / camel, HttpHeaderFilterStrategy - que bloquea solo el espacio de nombres de encabezado Camel en el límite HTTP - los dejó pasar de una solicitud HTTP entrante directamente al Exchange. En una ruta que conecta un consumidor HTTP (por ejemplo, platform-http) con un productor jira:, cualquier cliente HTTP podría, por lo tanto, proporcionar estos encabezados y anular los valores que la ruta pretendía, impulsando operaciones de JIRA contra la instancia de JIRA configurada con las credenciales de cuenta de servicio configuradas del endpoint - por ejemplo, eliminando o haciendo la transición de una incidencia arbitraria (a través de IssueKey / IssueTransitionId), creando una incidencia en un proyecto diferente (a través de ProjectKey), modificando campos de incidencia, añadiendo o eliminando observadores, o registrando trabajo. Las operaciones están limitadas por lo que la cuenta de servicio configurada tiene permitido hacer. No se requieren credenciales del atacante cuando el consumidor de conexión no está autenticado.\nEste problema afecta a Apache Camel: desde 4.0.0 antes de 4.14.8, desde 4.15.0 antes de 4.18.3, desde 4.19.0 antes de 4.21.0.\n\nSe recomienda a los usuarios actualizar a la versión 4.21.0, que corrige el problema. Si los usuarios están en la rama de versiones LTS 4.14.x, se sugiere que actualicen a 4.14.8. Si los usuarios están en la rama de versiones 4.18.x, se sugiere que actualicen a 4.18.3. Después de actualizar, las rutas que impulsan operaciones de JIRA a través de los nombres de encabezado sin procesar deben usar los nombres CamelJira (por ejemplo, CamelJiraIssueKey) en lugar de los valores antiguos. Para implementaciones que no pueden actualizarse inmediatamente, elimine los encabezados de control de camel-jira de cualquier entrada no confiable antes del productor jira: (por ejemplo, eliminando los encabezados IssueKey, ProjectKey, IssueTransitionId y relacionados al inicio de la ruta), y configure los parámetros de operación de JIRA requeridos desde una fuente confiable."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel JIRA",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.camel:camel-jira",
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.14.8",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.15.0",
              "lessThan": "4.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.19.0",
              "lessThan": "4.21.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T19:05:49.833194Z",
          "id": "CVE-2026-48206",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.14.8",
              "matchCriteriaId": "7662EB25-EAB6-493F-924C-5CA8A6F462B4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15.0",
              "versionEndExcluding": "4.18.3",
              "matchCriteriaId": "0AEE4159-4465-4ACD-B94A-1E4682C85270"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.19.0",
              "versionEndExcluding": "4.21.0",
              "matchCriteriaId": "1C2A1A7A-FADC-470F-8265-FA126AFD94ED"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://camel.apache.org/security/CVE-2026-48206.html",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/05/20",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}