CVE-2026-46453 is a medium-severity (CVSS 5.3) Improper Input Validation vulnerability in org.apache.camel:camel-elasticsearch-rest-client. A fix is available for org.apache.camel:camel-elasticsearch-rest-client — see the affected versions and patch details below.
Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-46453.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-46453 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
org.apache.camel:camel-elasticsearch-rest-client☕org.apache.camel:camel-elasticsearch-rest-client☕org.apache.camel:camel-elasticsearch-rest-clientReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client.
The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS and ID. The string values of these header constants, defined in ElasticSearchRestClientConstant, are plain unprefixed names ('SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', 'ID') rather than the 'Camel'-prefixed names used by every other Camel component (for example CamelSqlQuery, CamelMongoDbCriteria, CamelCqlQuery). Camel's inbound HTTP header filter, HttpHeaderFilterStrategy, blocks only header names that begin with 'Camel' or 'camel'. Because the Elasticsearch header names do not carry that prefix, they pass through the inbound filter unchanged. When a Camel route exposes an HTTP entry point (for example platform-http) in front of an elasticsearch-rest-client producer, an untrusted HTTP client can set these headers directly on its request and override the query and operation that the route author configured: reading every document in the index (SEARCH_QUERY with a match_all query), deleting documents (OPERATION set to Delete together with ID), or exfiltrating selected fields. No credentials are required and the producer reads the headers unconditionally. This issue affects Apache Camel: from 4.3.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix renames the camel-elasticsearch-rest-client Exchange header constant string values (ID, SEARCH_QUERY, INDEX_SETTINGS, INDEX_NAME, OPERATION) to carry the Camel prefix (CamelElasticsearchId, CamelElasticsearchSearchQuery, CamelElasticsearchIndexSettings, CamelElasticsearchIndexName, CamelElasticsearchOperation) so that they are blocked by the inbound HttpHeaderFilterStrategy; the Java field names are unchanged. For deployments that cannot upgrade immediately, strip the affected headers from untrusted inbound messages before they reach the producer (for example removeHeader('SEARCH_QUERY'), removeHeader('OPERATION'), removeHeader('INDEX_NAME'), removeHeader('INDEX_SETTINGS') and removeHeader('ID') in front of the elasticsearch-rest-client endpoint), or apply a custom HeaderFilterStrategy that blocks these names.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.camel:camel-elasticsearch-rest-client | ≥ 4.3.0&&< 4.14.8 | 4.14.8org.apache.camel:camel-elasticsearch-rest-client:4.14.8 |
| ☕Maven | org.apache.camel:camel-elasticsearch-rest-client | ≥ 4.15.0&&< 4.18.3 | 4.18.3org.apache.camel:camel-elasticsearch-rest-client:4.18.3 |
| ☕Maven | org.apache.camel:camel-elasticsearch-rest-client | ≥ 4.19.0&&< 4.21.0 | 4.21.0org.apache.camel:camel-elasticsearch-rest-client:4.21.0 |
Affected Products
camelapacheDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.camel:camel-elasticsearch-rest-client, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.camel:camel-elasticsearch-rest-client to 4.14.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-46453 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Moderate: This flaw in Red Hat build of Apache Camel allows remote, unauthenticated attackers to bypass authorization and control Elasticsearch queries and operations. This is due to specific Exchange header constants in the camel-elasticsearch-rest-client component not being filtered by default when a Camel route…
To mitigate this issue, configure the Camel route to strip the vulnerable headers from untrusted inbound messages before they reach the elasticsearch-rest-client producer. This can be achieved by adding `removeHeader('SEARCH_QUERY')`, `removeHeader('OPERATION')`, `removeHeader('INDEX_NAME')`, `removeHeader('INDEX_SETTINGS')`, and `removeHeader('ID')` in front of the elasticsearch-rest-client endpoint in the Camel route. Alternatively, apply a custom `HeaderFilterStrategy` to block these specific header names.Source: Red Hat security advisory for CVE-2026-46453 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-46453 in your dependencies?
Find it across Maven, including transitive dependencies.