CVE-2026-46588 Details

A vulnerability exists in the Apache Camel CouchDB component, affecting versions through 4.14.7, from 4.15.0 to 4.18.2, and from 4.19.0 to 4.20.0. The issue arises from improper input validation, where non-Camel-prefixed Exchange headers can bypass the default header filtering strategy. This allows untrusted HTTP clients to inject headers that override critical operation parameters in Camel routes, potentially leading to unauthorized modifications of database operations. The vulnerability is particularly concerning when the HTTP consumer is unauthenticated, as it requires no credentials to exploit.

Users should upgrade to Apache Camel versions 4.14.8, 4.18.3, or 4.21.0, all of which address this vulnerability. For those on the 4.14.x LTS release stream, version 4.14.8 should be installed. If on the 4.18.x release stream, upgrade to 4.18.3. The fix involves renaming the affected CouchDB header constants to include the Camel prefix, ensuring they are blocked by the inbound HttpHeaderFilterStrategy. For deployments unable to upgrade immediately, it is recommended to strip the affected headers from untrusted inbound messages before they reach the CouchDB producer, or to apply a custom HeaderFilterStrategy that blocks these header names.