CVE-2026-71300 is an improper input validation vulnerability in the Apache Camel Atmosphere Websocket component. The vulnerability arises because certain WebSocket dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) fall outside the Camel namespace filtering and can be manipulated by an external HTTP sender. This allows an attacker to override the producer's dispatch decision, potentially redirecting or suppressing messages intended for specific WebSocket clients. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability dates back to the introduction of these headers in version 2.17.0 and was fixed by renaming the headers into the Camel namespace, which is a breaking change for routes that set them by literal string. The recommended fix is upgrading to Apache Camel 4.22.0, 4.14.9, or 4.18.4 depending on the release stream. For those unable to upgrade immediately, stripping the dispatch headers at the trust boundary before the producer is advised.

An attacker who can send HTTP requests to a route bridging an HTTP consumer to an Atmosphere WebSocket producer can manipulate WebSocket dispatch headers. This can cause messages intended for one connected client to be suppressed or delivered to a different client whose connection key is known to the attacker. This undermines message delivery integrity and confidentiality within the WebSocket communication managed by Apache Camel. There is no indication of remote code execution or system compromise, but message routing can be hijacked.

A fix is available in Apache Camel versions 4.22.0, 4.14.9, and 4.18.4. Users should upgrade to these versions to remediate the vulnerability. For deployments unable to upgrade immediately, it is recommended to strip the dispatch headers (e.g., using removeHeaders("websocket.*")) at the trust boundary before the Atmosphere WebSocket producer. Additionally, avoid bridging an untrusted HTTP consumer directly into a WebSocket producer whose dispatch is header-driven without stripping these headers first. Note that the fix renames header string values into the Camel namespace, which may require route adjustments if headers are set by literal strings.