CVE-2026-48206

Sentinel/Defender KQL

let jira_headers = dynamic(['IssueKey', 'ProjectKey', 'IssueTransitionId', 'summary', 'type', 'assignee', 'components', 'watchers', 'linkType', 'work-log minutes']);
HttpRequests
| where Url contains "jira:" // Annahme: JIRA-Producer-Endpunkt im URL erkennbar
| where isnotempty(RequestHeaders)
| extend ParsedHeaders = parse_json(RequestHeaders)
| mv-expand ParsedHeaders
| where ParsedHeaders.Key in (jira_headers) and not(ParsedHeaders.Key startswith 'Camel') and not(ParsedHeaders.Key startswith 'camel')
| project TimeGenerated, ClientIp, RequestMethod, Url, ParsedHeaders.Key, ParsedHeaders.Value, UserAgent, Referer

Splunk SPL

sourcetype=apache_camel_logs (uri=*jira:*) (http_headers=*IssueKey* OR http_headers=*ProjectKey* OR http_headers=*IssueTransitionId* OR http_headers=*linkType*)
| rex field=http_headers "(?<header_name>[^=,]+)=(?<header_value>[^,]+)"
| where NOT header_name LIKE "Camel%" AND NOT header_name LIKE "camel%"
| table _time, clientip, method, uri, header_name, header_value, useragent

Sigma

title: Apache Camel JIRA Header Bypass Attempt
status: experimental
description: Detects attempts to bypass HTTP header filtering in Apache Camel JIRA component by using non-Camel-prefixed JIRA control headers.
logsource:
  product: web
  service: access_logs
detection:
  selection:
    uri|contains: 'jira:'
    http_headers|contains:
      - 'IssueKey'
      - 'ProjectKey'
      - 'IssueTransitionId'
      - 'linkType'
  condition: selection
  filter:
    http_headers|startswith:
      - 'Camel'
      - 'camel'
  falsepositives:
    - Legitimate internal applications that explicitly use these headers (after upgrade)
level: medium

Elastic ES|QL

FROM logs
| WHERE event.dataset == "apache.camel.access"
| WHERE url.path LIKE "%jira:%"
| WHERE http.request.headers.IssueKey IS NOT NULL OR http.request.headers.ProjectKey IS NOT NULL OR http.request.headers.IssueTransitionId IS NOT NULL OR http.request.headers.linkType IS NOT NULL
| WHERE NOT (http.request.headers.IssueKey LIKE "Camel%" OR http.request.headers.IssueKey LIKE "camel%" OR
             http.request.headers.ProjectKey LIKE "Camel%" OR http.request.headers.ProjectKey LIKE "camel%" OR
             http.request.headers.IssueTransitionId LIKE "Camel%" OR http.request.headers.IssueTransitionId LIKE "camel%" OR
             http.request.headers.linkType LIKE "Camel%" OR http.request.headers.linkType LIKE "camel%")
| SELECT @timestamp, source.ip, http.request.method, url.original, http.request.headers, user_agent.original