A critical input validation vulnerability in Apache Camel allows unauthenticated remote attackers to hijack message dispatching, potentially leading to unauthorized data exposure or complete communication interception.

The vulnerability exists because the Atmosphere Websocket producer fails to properly filter header values that fall outside the standard Camel namespace. An unauthenticated attacker can inject specific headers to override intended message recipients and redirect traffic to unauthorized WebSocket peers.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity and the ease of remote exploitation. Successful exploitation could lead to the unauthorized interception of sensitive data, disruption of critical messaging flows, and a complete breakdown of communication integrity within affected enterprise integrations.

Immediate Action: Upgrade to Apache Camel version 4.14.9, 4.18.4, 4.22.0, or higher, depending on your current release branch.

Proactive Monitoring: Review application logs for unusual HTTP header activity, particularly requests containing unexpected websocket prefix headers, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or header filtering at the Web Application Firewall (WAF) or API Gateway layer to block requests containing unauthorized websocket-related headers before they reach the Camel application.

Public Exploit Available: Yes — a public proof-of-concept exists via the GitHub repository referenced in the enrichment data.

Given the high impact and the availability of public proof-of-concept code, this vulnerability poses an immediate threat to the integrity of data handled by Apache Camel. Organizations should prioritize updating their Camel deployments to the latest patched versions to eliminate this attack vector. If patching is not immediately feasible, ensure that network perimeter defenses are configured to inspect and sanitize incoming HTTP headers.