CVE-2026-33454 -- CVSS 9.4 Vulnerability Briefing

CVE-2026-33454 | CVSS 9.4 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-33454 is a header injection vulnerability in the Camel-Mail component of Apache Camel, allowing attackers to inject arbitrary mail headers into outbound email messages processed by the framework.

Technical Detail

The flaw exists in the custom header filter strategy used by Camel-Mail, specifically the MailHeaderFilterStrategy class, which applies filtering only to the outbound ("out") direction via the setOut method, leaving inbound or internally propagated Camel message headers unfiltered before they are written into outgoing mail. An attacker who can influence Camel message headers, for example through a crafted upstream message or a manipulated route input, can inject additional mail headers such as CC, BCC, or custom SMTP headers into the resulting email. Depending on deployment context, this could be leveraged for email spoofing, spam relay abuse, data exfiltration via blind-copied recipients, or manipulation of downstream mail processing logic. The CVSS score of 9.4 (Critical) reflects the low complexity and significant impact potential of successful exploitation.

Exploitation Status

No known exploit code has been identified for this vulnerability as of May 4, 2026. The exploit maturity is currently assessed as no known exploit, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. This status should be monitored closely given the critical severity rating and the relative simplicity of header injection techniques.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence sources.

What To Do

Organizations using Apache Camel with the Camel-Mail component should apply the vendor-supplied patch as soon as it becomes available and treat this as a high-priority remediation given the critical CVSS score. As an interim workaround, teams should implement explicit header sanitization within their Camel routes before messages reach the mail endpoint, stripping or validating any headers derived from untrusted input sources. Deployments should audit existing Camel-Mail routes to identify any paths where external or user-controlled data can influence message headers. Detection can be assisted by monitoring outbound SMTP traffic for anomalous or unexpected headers, particularly BCC or custom headers not defined in application logic. Subscribe to Apache Camel security advisories for patch release notifications.