CVE-2026-49086: Apache Camel Dapr Pub/Sub Routing Bypass Vulnerability

Vulnerability Overview Vulnerability Name: CVE-2026-49086 Severity: Medium Description: The Dapr Pub/Sub consumer copies the pub/sub name and topic from incoming CloudEvents into the routing headers for the producer direction. These headers correspond to the producer routing headers: when the message is re-published via the Dapr producer, reads these headers and gives them precedence over the destination configured on the endpoint. Consequently, in routing scenarios where messages are re-published from one Dapr Pub/Sub topic to another (e.g., from to ), a participant able to publish to the subscription topic can set the CloudEvent's pub/sub name and topic to arbitrary values. This causes the re-published message to be sent to any Dapr Pub/Sub component and topic, rather than the intended configured destination. This effectively redirects or bypasses the intended routing of messages and routes, as well as any topic-level access control in the underlying broker. Exploitation requires the ability to publish to the subscription topic of the route; no additional authentication or user interaction is required. Affected Versions Affected Versions: 4.12.0 to 4.14.8, 4.15.0 to 4.18.3, and 4.19.0 to 4.21.0. Remediation Fixed Versions: 4.14.8, 4.18.3, and 4.21.0. Mitigation: Users are advised to upgrade to version 4.21.0, which resolves the issue. If using the 4.14.x LTS release stream, upgrade to 4.14.8. If using the 4.18.x release stream, upgrade to 4.18.3. For deployments that cannot be upgraded immediately, remove the and headers from any Dapr consumers and routing-based Dapr producers (e.g., using ), and restrict who can publish to the subscribed Dapr Pub/Sub topics so that only trusted producers can send messages. Additional Information JIRA Link: https://issues.apache.org/jira/browse/CAMEL-23630 MITRE CVE Entry: https://www.cve.org/CVERecord?id=CVE-2026-49086 Discovered By: Leon Zbiecki

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-49086: Apache Camel Dapr Pub/Sub Routing Bypass Vulnerability