Improper Input Validation vulnerability in Apache Camel Cometd Component.

The camel-cometd component maps inbound Bayeux (CometD) message headers into the Came…

CVE-2026-46454 is an Improper Input Validation vulnerability in the Apache Camel camel-cometd component. The CometdBinding.populateExchangeFromMessage method copies the entire ext.CamelHeaders map from inbound Bayeux messages directly into the Camel Exchange without applying a HeaderFilterStrategy. This allows unauthenticated clients—since no Bayeux SecurityPolicy is installed by default—to inject arbitrary Camel internal control headers such as CamelHttpUri, CamelFileName, or CamelJmsDestinationName. These injected headers can influence downstream producer behavior including redirecting HTTP requests, altering file names, or overriding JMS destinations, and persist across internal direct, seda, and vm hops. Affected versions include Apache Camel 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0. The fix implements a HeaderFilterStrategy that filters Camel-prefixed headers case-insensitively on inbound mapping. Users unable to upgrade immediately should manually strip Camel control headers and install an explicit Bayeux SecurityPolicy.