CVE-2026-49086
MEDIUM(6.5)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS 6.5 — Mittel
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.7%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
6.5
Technische Schwere
Beschreibung
Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from('dapr-pubsub:p:t').to('dapr-pubsub:p:other')), an actor able to publish a message to the subscribed topic could set the CloudEvent's pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route's intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, remove the CamelDaprPubSubName and CamelDaprTopic headers from the Exchange between the Dapr consumer and any Dapr producer in the route (for example removeHeaders('CamelDaprPubSubName', 'CamelDaprTopic')), and restrict who can publish to the subscribed Dapr Pub/Sub topic so that only trusted producers can send to it.
Erkennung & Indikatoren
Ausnutzung
Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed.
Behobene Versionen
- 4.14.8
- 4.18.3
- 4.21.0
Threat-Hunting-Queries
Detection focuses on the behavioral aspect of an actor publishing messages to a Dapr Pub/Sub topic with manipulated CloudEvent headers (pub/sub-name and topic) that are then re-published by Apache Camel to an unintended destination. This requires logging of Dapr Pub/Sub interactions and Apache Camel Exchange header modifications/usage.
Sentinel/Defender KQL
DaprLogs
| where Message has "CloudEvent" and Message has "pub/sub-name" and Message has "topic"
| join kind=inner (CamelLogs
| where Message has "CamelDaprPubSubName" or Message has "CamelDaprTopic"
| extend OriginalPubSubName = extract(@'CamelDaprPubSubName=([^,]+)', 1, Message)
| extend OriginalTopic = extract(@'CamelDaprTopic=([^,]+)', 1, Message)
) on $left.CorrelationId == $right.CorrelationId // Assuming a correlation ID exists
| where OriginalPubSubName != ExpectedPubSubName or OriginalTopic != ExpectedTopic // Compare with expected values for the route
| project TimeGenerated, Source, Message, OriginalPubSubName, OriginalTopic, ExpectedPubSubName, ExpectedTopicSplunk SPL
index=dapr sourcetype=cloudevent "pub/sub-name" "topic"
| join type=inner _time
[search index=camel sourcetype=camel_dapr (CamelDaprPubSubName OR CamelDaprTopic)
| rex "CamelDaprPubSubName=(?<OriginalPubSubName>[^,]+)"
| rex "CamelDaprTopic=(?<OriginalTopic>[^,]+)"]
| where OriginalPubSubName!=ExpectedPubSubName OR OriginalTopic!=ExpectedTopicSigma
title: Apache Camel Dapr Pub/Sub Redirection Attempt
author: SecBoard
date: 2026/07/05
logsource:
product: apache_camel
service: dapr
detection:
selection:
- message|contains: 'CloudEvent'
- message|contains: 'pub/sub-name'
- message|contains: 'topic'
- message|contains: 'CamelDaprPubSubName'
- message|contains: 'CamelDaprTopic'
condition: selection
falsepositives:
- Legitimate Dapr Pub/Sub message processing where headers are intentionally modified (unlikely for routing headers)
level: highElastic ES|QL
FROM dapr_logs
| WHERE message LIKE '%CloudEvent%' AND message LIKE '%pub/sub-name%' AND message LIKE '%topic%'
| JOIN dapr_logs AS dapr_events, camel_logs AS camel_events
ON dapr_events.correlation_id = camel_events.correlation_id
| WHERE camel_events.message LIKE '%CamelDaprPubSubName%' OR camel_events.message LIKE '%CamelDaprTopic%'
| EXTRACT camel_events.message, 'CamelDaprPubSubName=(?<original_pubsub_name>[^,]+)'
| EXTRACT camel_events.message, 'CamelDaprTopic=(?<original_topic>[^,]+)'
| WHERE original_pubsub_name != expected_pubsub_name OR original_topic != expected_topicSecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.
Indikatoren
Datei-Hashes (3)
- 72d13bd13fb5960ea1b367a2e379f017c1720c5c
- 86276a2ccc2cf8b09d7efeb38d9770845c4e1bea
- c6fc9bb21670e5c65ea14df0f3f29baef78c2028
Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.
GitHub Advisories
Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers