Apache Camel CVE-2026-48204 Advisory: Pre-Auth GridFS Op Switching Leading to File Deletion/NoSQLi

Vulnerability Overview CVE-2026-48204 Severity: Medium Summary: The control headers in the Camel-MongoDB-GridFS component use unprefixed names, bypassing the HTTP header filter and allowing HTTP clients to switch GridFS operations, including destructive file deletion under default configurations. Description: The Camel-mongodb-gridfs producer controls GridFS operations via the exchange header. When the endpoint operation parameter is not set (the default case), the control header constants (such as , , etc.) are represented as plain strings , , etc. These names do not use the Camel/camel prefix and are not subject to , meaning they are passed directly through the HTTP boundary to the mongodb-gridfs producer. When an HTTP consumer (e.g., platform-http) is bridged to the mongodb-gridfs producer in a route, any HTTP client can therefore set the header to override the intended route operation. For example, after uploading a file, an attacker can trigger deletion (by listing all files in the bucket via or reading a file via ) and provide a value that resolves to a MongoDB document, thereby achieving NoSQL query injection. This exploitation requires no credentials when the bridged consumer is unauthenticated. Affected Versions Affected Versions: - 4.0.0 to 4.14.8 - 4.15.0 to 4.18.3 - 4.19.0 to 4.21.0 Fix Details Fixed Versions: - 4.14.8 - 4.18.3 - 4.21.0 Mitigation: - Users are advised to upgrade to version 4.21.0 to fix the issue. - If using the 4.14.x LTS release stream, upgrade to 4.14.8. - If using the 4.18.x release stream, upgrade to 4.18.3. - After upgrading, the original header names used to drive GridFS operations or metadata must be changed from to , , , , and . - For deployments unable to upgrade immediately, set an explicit operation on the endpoint so that the operation is not derived from headers, and strip headers from untrusted ingress points. References PGP Signed Announcement Data: CVE-2026-48204.txt.asc Mitre CVE Entry: CVE-2026-48204 Additional Information JIRA Ticket: CAMEL-23575 Fix Commits: - Main branch: commit 8f0d1ac - camel-4.18.x: commit 054d0c1e - camel-4.14.x: commit 9915ad46 Contributors This issue was discovered by Yu Bao from PayPal.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel CVE-2026-48204 Advisory: Pre-Auth GridFS Op Switching Leading to File Deletion/NoSQLi