The vulnerability exists in the Apache Camel Knative consumer where inbound CloudEvent attributes are mapped to Camel message headers. In structured content mode (application/cloudevents+json), CloudEvent extension fields are copied directly into Exchange headers without applying header filtering, allowing injection of Camel-internal headers such as CamelHttpUri, CamelHttpPath, and CamelFileName. This can override configured values in routes forwarding messages to header-driven components, enabling SSRF, path traversal, or message dispatch redirection. This is a partial fix of a previously addressed issue in binary content mode and is related to similar header filtering vulnerabilities in other Camel components. Affected versions include 3.15.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.21.0. Fixed versions are 4.14.9, 4.18.4, and 4.22.0.

An unauthenticated attacker can inject internal headers in structured-mode CloudEvent requests, potentially causing server-side request forgery, path traversal, or message dispatch redirection. This can lead to unauthorized access or manipulation of backend services or files depending on the route configuration.

Users should upgrade to Apache Camel versions 4.14.9, 4.18.4, or 4.22.0, depending on their release stream. Non-LTS versions 4.15.0 through 4.17.0 and 4.19.0 through 4.21.0 are affected and do not receive maintenance fixes; users on these versions should upgrade to 4.18.4 or 4.22.0. Patch status is confirmed by vendor advisory. No alternative mitigations are indicated.