CVE-2026-48204: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a mongodb-gridfs: producer with no explicit operation, any HTTP client could therefore set the gridfs.operation header to override the route's intended operation - switching, for example, a file upload to remove (deleting a file identified by the attacker-supplied gridfs.objectid), listAll (enumerating every file in the bucket) or findOne (reading a file) - and supply a gridfs.metadata value that is parsed as a MongoDB document, enabling NoSQL operator injection. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive GridFS operations or metadata via the raw header names must use CamelGridFsOperation / CamelGridFsObjectId / CamelGridFsMetadata / CamelGridFsChunkSize / CamelGridFsFileId instead of the gridfs.* names. For deployments that cannot upgrade immediately, set an explicit operation on the mongodb-gridfs: endpoint so the operation is not taken from a header, and strip the gridfs.* headers from any untrusted ingress before the producer.
AI Analysis
Technical Summary
The camel-mongodb-gridfs producer in Apache Camel selects the GridFS operation from the gridfs.operation HTTP header when the endpoint's operation parameter is unset. Since the gridfs.* headers lack the Camel prefix, they bypass HttpHeaderFilterStrategy, allowing an attacker to control the GridFS operation via HTTP requests. This can lead to unauthorized file removal, listing, or reading, and enables NoSQL operator injection through crafted gridfs.metadata values. No authentication is required if the HTTP consumer is unauthenticated. The vulnerability affects Apache Camel versions >=4.0.0 <4.14.8, >=4.15.0 <4.18.3, and >=4.19.0 <4.21.0. Users should upgrade to 4.14.8, 4.18.3, or 4.21.0 respectively. Alternatively, setting an explicit operation on the mongodb-gridfs endpoint or stripping gridfs.* headers from untrusted ingress can mitigate the issue.
Potential Impact
An attacker can manipulate HTTP headers to override the intended GridFS operation in Apache Camel routes that bridge HTTP consumers to mongodb-gridfs producers without explicit operation settings. This can lead to unauthorized file deletion, file enumeration, file reading, and NoSQL operator injection via metadata. The vulnerability does not require credentials if the HTTP consumer is unauthenticated, increasing the risk of unauthorized access and data manipulation.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.8, 4.18.3, and 4.21.0. Users are strongly recommended to upgrade to these versions. After upgrading, routes must use Camel-prefixed header names (CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize, CamelGridFsFileId) instead of the gridfs.* headers. For deployments unable to upgrade immediately, set an explicit operation parameter on the mongodb-gridfs endpoint to prevent operation selection from headers, and strip gridfs.* headers from any untrusted HTTP ingress to block unauthorized overrides.
CVE-2026-48204: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel
Description
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a mongodb-gridfs: producer with no explicit operation, any HTTP client could therefore set the gridfs.operation header to override the route's intended operation - switching, for example, a file upload to remove (deleting a file identified by the attacker-supplied gridfs.objectid), listAll (enumerating every file in the bucket) or findOne (reading a file) - and supply a gridfs.metadata value that is parsed as a MongoDB document, enabling NoSQL operator injection. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that drive GridFS operations or metadata via the raw header names must use CamelGridFsOperation / CamelGridFsObjectId / CamelGridFsMetadata / CamelGridFsChunkSize / CamelGridFsFileId instead of the gridfs.* names. For deployments that cannot upgrade immediately, set an explicit operation on the mongodb-gridfs: endpoint so the operation is not taken from a header, and strip the gridfs.* headers from any untrusted ingress before the producer.
CVSS v3.1
Score 9.8critical
Affected software
pkg:maven/Apache Software Foundation/org.apache.camel:camel-mongodb-gridfsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The camel-mongodb-gridfs producer in Apache Camel selects the GridFS operation from the gridfs.operation HTTP header when the endpoint's operation parameter is unset. Since the gridfs.* headers lack the Camel prefix, they bypass HttpHeaderFilterStrategy, allowing an attacker to control the GridFS operation via HTTP requests. This can lead to unauthorized file removal, listing, or reading, and enables NoSQL operator injection through crafted gridfs.metadata values. No authentication is required if the HTTP consumer is unauthenticated. The vulnerability affects Apache Camel versions >=4.0.0 <4.14.8, >=4.15.0 <4.18.3, and >=4.19.0 <4.21.0. Users should upgrade to 4.14.8, 4.18.3, or 4.21.0 respectively. Alternatively, setting an explicit operation on the mongodb-gridfs endpoint or stripping gridfs.* headers from untrusted ingress can mitigate the issue.
Potential Impact
An attacker can manipulate HTTP headers to override the intended GridFS operation in Apache Camel routes that bridge HTTP consumers to mongodb-gridfs producers without explicit operation settings. This can lead to unauthorized file deletion, file enumeration, file reading, and NoSQL operator injection via metadata. The vulnerability does not require credentials if the HTTP consumer is unauthenticated, increasing the risk of unauthorized access and data manipulation.
Mitigation Recommendations
A fix is available in Apache Camel versions 4.14.8, 4.18.3, and 4.21.0. Users are strongly recommended to upgrade to these versions. After upgrading, routes must use Camel-prefixed header names (CamelGridFsOperation, CamelGridFsObjectId, CamelGridFsMetadata, CamelGridFsChunkSize, CamelGridFsFileId) instead of the gridfs.* headers. For deployments unable to upgrade immediately, set an explicit operation parameter on the mongodb-gridfs endpoint to prevent operation selection from headers, and strip gridfs.* headers from any untrusted HTTP ingress to block unauthorized overrides.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-05-21T09:00:09.248Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b6cae27e9c79719252376
Added to database: 07/06/2026, 08:51:58 UTC
Last enriched: 07/06/2026, 09:08:06 UTC
Last updated: 07/06/2026, 23:07:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.