CVE-2026-85312: CWE-20 Improper Input Validation in Apache Software Foundation Apache Camel

The vulnerability arises because the saga processor in Apache Camel Core consulted the Long-Running-Action header, which is outside the Camel namespace and thus not filtered by consumer header filters. This allowed an external sender to supply this header on inbound messages, potentially associating their request with a saga initiated by another user or causing unintended compensation actions. The exposure is limited to deployments using sagas over an LRA coordinator. The fix involves consulting the header only for saga services that actually use it and is included in Apache Camel 4.18.5, 4.22.1, and 4.23.0.

An attacker could supply the Long-Running-Action header on inbound messages to improperly associate their requests with existing sagas or cause compensation actions to be triggered for actions they did not initiate. This could lead to unintended side effects in long-running transactions managed by Apache Camel sagas. The confidentiality and integrity impact is low, as indicated by the CVSS score, and availability is not affected.

Upgrade Apache Camel to version 4.18.5 if using the 4.18.x LTS stream, to 4.22.1 if using the 4.22.x LTS stream, or to 4.23.0 for other versions. For deployments that cannot upgrade immediately, remove the Long-Running-Action header at the trust boundary by applying removeHeaders("Long-Running-Action") on every consumer that accepts messages from untrusted senders. This prevents untrusted external input from influencing saga association.