CVE-2026-48203Disclosure(apache / camel)

LOWCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for apache camel systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField. prefix into the fields of the indexed Solr document. The prefix constants (SolrConstants.HEADER_PARAM_PREFIX / HEADER_FIELD_PREFIX) were the plain strings SolrParam. / SolrField.. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a solr: producer, any HTTP client could therefore set SolrParam.* headers to inject arbitrary Solr request parameters - including shards or stream.url, which cause the Solr server to issue server-side requests to an attacker-chosen URL (server-side request forgery, for example to an internal service or a cloud metadata endpoint), or qt to reach administrative request handlers - and set SolrField.* headers to inject arbitrary fields into indexed documents. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, routes that set Solr parameters or fields via the raw header prefixes must use CamelSolrParam. / CamelSolrField. instead of SolrParam. / SolrField.. For deployments that cannot upgrade immediately, strip the SolrParam.* and SolrField.* headers from any untrusted ingress before the solr: producer, and set the required Solr parameters and fields from a trusted source in the route.

apache CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-20CWE-74CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

camel

Threat summary

Public PoC and exploit tooling are both present
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-07); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

apache

Products

camel

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Exploit

150.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-07	1	Disclosure1
2026-07-17	1	Exploit1

Full discourse2 posts

vulntoday@vulntoday102d
Disclosure
🔴 CRITICAL CVE-2026-48203 Server-side request forgery and parameter/field injection in the Apache Camel camel-solr component (4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0) allows remote attackers to con… https://vuln.today/cve/CVE-2026-48203 #CVE #infosec
Post summary
The tweet announces the discovery of the critical CVE‑2026‑48203, detailing it as a server‑side request forgery and parameter/field injection flaw in the Apache Camel camel‑solr component with specific version ranges, but provides no PoC, exploit code, patch, or evidence of active exploitation.
40040176
23 followersView on X
dbugs@ptdbugs92d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-48203 PT ID: PT-2026-55899 Vendor: Apache Software Foundation Product: Apache Camel Description: An injection and Server-Side Request Forgery (SSRF) issue exists in the Apache Camel Solr component. The camel-solr producer copies Exchange message headers starting with the SolrParam. prefix into Solr request parameters and those starting with SolrField. into indexed Solr document fields. Because these prefixes do not start with the Camel or camel namespace, the HttpHeaderFilterStrategy allows them to pass from inbound HTTP requests into the Exchange. In routes bridging an HTTP consumer to a solr: producer, an unauthenticated attacker can inject arbitrary Solr request parameters via SolrParam.* headers—such as shards or stream.url to trigger SSRF toward internal services or cloud metadata endpoints, or qt to access administrative handlers—and inject arbitrary fields into documents via SolrField.* headers. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-55899 • https://github.com/oscerd/CVE-2026-48203 #dbugs_vuln
Post summary
An exploit and PoC for CVE-2026-48203 targeting Apache Camel's Solr component have been disclosed, detailing injection and SSRF vectors, but no active exploitation or patch information is provided.
00021473
3.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	camel	-	-	-

Explore more

Back to dashboard apache CVEs camel vulnerabilities