Apache Camel Core Improper Input Validation via Saga Header (4.0.0-4.22.1)
CVE-2026-85312 Published on October 19, 2026
Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
Improper Input Validation vulnerability in Apache Camel Core component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders("Long-Running-Action") on every consumer that accepts messages from an untrusted sender.
Vulnerability Analysis
CVE-2026-85312 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2026-85312
Want to know whenever a new CVE is published for Apache Camel? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Camel:- Version 4.0.0 and below 4.18.5 is affected.
- Version 4.19.0 and below 4.22.1 is affected.
- Version 4.18.5 is unaffected.
- Version 4.22.1 is unaffected.
- Version 4.23.0 is unaffected.