The vulnerability (CVE-2026-47323) in Apache Camel affects the CXF and Knative HeaderFilterStrategy implementations, which only filter outbound Camel-internal headers but do not filter inbound headers. This allows an unauthenticated attacker to inject Camel-internal headers such as CamelExecCommandExecutable or CamelFileName via HTTP requests to CXF-RS or CXF-SOAP endpoints. When these messages are forwarded to header-driven components like camel-exec or camel-file, the injected headers can override intended configurations, enabling remote code execution or arbitrary file writes. This vulnerability affects Apache Camel versions from 3.18.0 before 4.14.6 and from 4.15.0 before 4.18.2. The issue is addressed by upgrading to versions 4.14.6, 4.18.2, or 4.19.0.

An unauthenticated attacker can inject internal headers into HTTP requests, which may override configuration values in components that rely on these headers. This can lead to remote code execution or arbitrary file writes, posing a significant security risk to affected systems running vulnerable Apache Camel versions.

Users should upgrade Apache Camel to version 4.19.0. For those on the 4.18.x LTS stream, upgrade to 4.18.2 is recommended. For users on the 4.14.x LTS stream, upgrading to 4.14.6 addresses the vulnerability. Patch status is confirmed by the vendor advisory recommending these upgrades. No alternative mitigations are indicated.