A critical input validation vulnerability in Apache Camel allows unauthenticated remote attackers to bypass security filters, potentially leading to unauthorized message redirection and system compromise.

The Undertow component fails to correctly apply header filtering due to an object initialization error, where the default strategy is overwritten before use. This allows unauthenticated attackers to send crafted HTTP headers that are processed as dispatch directives, enabling unauthorized control over WebSocket communication.

The vulnerability carries a CVSS score of 9.8, reflecting its critical potential for remote exploitation without authentication. Successful exploitation could lead to full system compromise, unauthorized data access, or the redirection of sensitive traffic to attacker-controlled endpoints, posing severe risks to operational integrity and data confidentiality.

Immediate Action: Update the Apache Camel Undertow component to versions 4.14.9, 4.18.4, or 4.22.0, depending on the current deployment branch.

Proactive Monitoring: Monitor network traffic and application logs for anomalous HTTP headers or unexpected WebSocket dispatch behavior, particularly those involving the legacy websocket exchange prefix.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway configured to inspect and strip unrecognized or legacy websocket-related headers from incoming requests.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the critical severity of this vulnerability and the availability of proof-of-concept code, organizations must treat this as a high-priority remediation task. Administrators should verify their Apache Camel version immediately and apply the provided patches to prevent potential unauthorized access and message hijacking within their integration environments.