Alertas de Seguridad de la Información

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-53913] Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failin…

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is no…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55993] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache …

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value was the plain string QUERY (and RETURN_LUCENE_DOCS for HEADER_RETURN_LUCENE_DOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderF…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46590] Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc compon…

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46591] Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J …

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JS…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa…

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operat…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46726] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (VertxWebsocketConsumer.populateExchangeHeaders()). Be…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48203] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), …

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48205] Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS comp…

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers whose constant values (DnsConstants.DNS_SERVER, DNS_NAME, DNS_DOMAIN, DNS_TYPE, DNS_CLASS, TERM) were t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-43867] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc compon…

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46454] Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen…

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46455] Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloa…

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default check…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46456] Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs com…

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46457] Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component ma…

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules configured (NatsConfiguration). With no inFilter, inFilterPattern or inFilterStartsWith set, DefaultHeaderFilterStrategy.applyFilterToExter…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-24012] Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose re…

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and c…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-24013] Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers l…

Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and, without performing openSession authentication, receive valid query results. This allows authentication bypass and unauthorized reading of time-series data. This issue affects Apache Io…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-24014] Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trig…

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file writ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-40047] Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in …

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-40859] Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component des…

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is config…

nvdaltovulnerabilidad CVSS 8.1 NVD