CVE-2026-40453 -- CVSS 9.9 Vulnerability Briefing

CVE-2026-40453 | CVSS 9.9 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-40453 is a header injection filter bypass vulnerability in Apache Camel that allows attackers to smuggle restricted Camel headers through HTTP requests by exploiting an incomplete case-normalization fix.

Technical Detail

The prior fix for CVE-2025-27636 introduced setLowerCase(true) in Apache Camel's HttpHeaderFilterStrategy to block case-variant header names such as CAmelExecCommandExecutable from bypassing the header denylist. CVE-2026-40453 indicates that this fix was incomplete, meaning an attacker can still craft specially cased or otherwise variant header names that evade the filter and reach internal Camel processing logic. Successful exploitation could allow an unauthenticated or low-privileged remote attacker to inject Camel execution headers, potentially leading to remote code execution depending on the components and routes configured in the target application.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently unconfirmed, and CVE-2026-40453 has not been added to the CISA Known Exploited Vulnerabilities catalog. Given the high CVSS score of 9.9 and the direct lineage to CVE-2025-27636, which has a documented exploitation history, this vulnerability warrants close monitoring for emerging proof-of-concept or active exploitation activity.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with CVE-2026-40453 as of May 4, 2026. However, Apache Camel is widely deployed in enterprise integration and middleware environments, making it a historically attractive target for actors seeking initial access or lateral movement within backend infrastructure.

What To Do

Organizations running Apache Camel should treat this as a high-priority patch given the critical CVSS score and the known exploitation history of the predecessor vulnerability CVE-2025-27636. Apply the latest available Apache Camel patch that addresses this bypass as soon as it is released, and verify that the updated HttpHeaderFilterStrategy correctly normalizes all header name variants before filtering. As an interim measure, operators should restrict external HTTP access to Camel endpoints where possible and audit route configurations to identify any use of CamelExec or similar execution-capable components that could be triggered via header injection. Monitor ingress HTTP traffic for anomalous header names containing mixed-case variants of known Camel header prefixes as a detection signal.