CVE-2026-55994 Apache CVE debrief

Who should care

Users of Apache Camel from version 4.17.0 before 4.18.3, and from 4.19.0 before 4.21.0, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes upgrading to Apache Camel version 4.21.0 or later, or implementing a dedicated IggyHeaderFilterStrategy to filter Camel header namespace. Additionally, users should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Technical summary

CVE-2026-55994 is an Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel's Iggy component. The camel-iggy consumer mapped user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy. This allows an actor able to publish to the consumed Iggy stream/topic to set Camel-internal control headers, including CamelHttpUri, which can redirect the server-side HTTP request to an attacker-chosen destination, and disclose environment variables, application properties, and vault secrets.

Defensive priority

High priority due to the HIGH CVSS score of 7.5 and potential for sensitive information disclosure and SSRF attacks.

Recommended defensive actions

• Upgrade to Apache Camel version 4.21.0 or later
• If on the 4.18.x releases stream, upgrade to 4.18.3
• Implement a dedicated IggyHeaderFilterStrategy to filter Camel header namespace
• Strip Camel control headers from inbound messages
• Restrict who can publish to the consumed Iggy stream/topic
• Avoid bridging an untrusted consumer directly into an HTTP producer
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, affected versions, and potential impacts. Vendor advisory and third-party advisory references are available for mitigation and additional information. The vulnerability allows an actor to publish to the consumed Iggy stream/topic to set Camel-internal control headers, including CamelHttpUri, which can redirect the server-side HTTP request to an attacker-chosen destination, and disclose environment variables, application properties, and vault secrets. There is no evidence of exploitation in the wild, but users should take necessary actions to mitigate the risk.

Official resources