The vulnerability is an instance of Improper Input Validation (CWE‑20). When the camel‑nats component receives a message, it copies every header from the inbound NATS message into the Camel Exchange without filtering. A client that can publish to the consumed subject can therefore inject arbitrary headers, including Camel internal control headers such as CamelHttpUri, CamelFileName or CamelSqlQuery. These injected headers are preserved across internal hops, allowing the attacker to redirect HTTP calls, change file names, or override queries used by downstream producers, potentially causing misdirected traffic, data leakage, or execution of unintended processing.

Apache Camel’s camel‑nats component is affected in the following ranges: 4.0.0 up to but not including 4.14.8, 4.15.0 up to but not including 4.18.3, and 4.19.0 up to but not including 4.21.0. The flaw exists only when the NATS server supports message headers (NATS 2.2 or later) and is configured without authentication, which is the default server configuration.

The EPSS score is less than 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.5 denotes high severity. Because the injection can be performed by any publisher to the subscribed NATS subject and unauthenticated publishing is allowed by default, the attack vector is remote and requires only the ability to publish to the subject. The impact is confined to the integrity and availability of downstream routing components, but could be significant if the compromised headers influence sensitive operations.