The camel‑elasticsearch‑rest‑client component exposes several Exchange headers—SEARCH_QUERY, OPERATION, INDEX_NAME, INDEX_SETTINGS, and ID—whose values are plain unprefixed names. Because Camel’s inbound HTTP header filter only blocks headers that start with "Camel" or "camel", an attacker can override the query and operation the route author intended, enabling arbitrary reads, deletes, or data exfiltration from an underlying Elasticsearch cluster without any authentication.

This vulnerability affects Apache Camel versions 4.3.0 through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.9. The fixed releases are 4.14.8, 4.18.3, and 4.21.0. Systems using the camel‑elasticsearch‑rest‑client component behind an HTTP entry point are particularly at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to send a crafted HTTP request to a Camel route that forwards to the Elasticsearch Rest Client; no credentials are required. Successful exploitation can lead to full data exfiltration, unauthorized deletion, or other integrity violations, making the risk significant for systems handling sensitive data.