Apache Camel's CXF and Knative HeaderFilterStrategy implementations (specifically CxfRsHeaderFilterStrategy, CxfHeaderFilterStrategy, and KnativeHttpHeaderFilterStrategy) improperly handle inbound filtering of Camel-internal headers. They only filter outbound headers via setOutFilterStartsWith but do not configure inbound filtering via setInFilterStartsWith. This flaw permits unauthenticated attackers to inject internal headers such as CamelExecCommandExecutable and CamelFileName through HTTP requests to CXF-RS or CXF-SOAP endpoints. When messages are routed to header-driven components like camel-exec or camel-file, the injected headers can override configured values, enabling remote code execution or arbitrary file writes. This vulnerability affects Apache Camel versions from 3.18.0 before 4.14.6 and from 4.15.0 before 4.18.2. The issue is addressed in versions 4.14.6, 4.18.2, and 4.19.0. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity.

An unauthenticated attacker can inject internal Camel headers via HTTP requests to vulnerable CXF-RS or CXF-SOAP endpoints. This injection can override critical configuration values in header-driven components, potentially leading to remote code execution or arbitrary file writes. The impact includes full confidentiality, integrity, and availability compromise of affected systems running vulnerable Apache Camel versions.

Users should upgrade to Apache Camel version 4.19.0 to fully remediate this vulnerability. For those on the 4.18.x LTS stream, upgrading to 4.18.2 is recommended. For users on the 4.14.x LTS stream, upgrading to 4.14.6 addresses the issue. No other mitigations or workarounds are specified in the vendor advisory. Patch status is confirmed by vendor advisories linked, and these versions contain the official fix.