Apache Camel's CouchDB component contains an improper input‑validation flaw that allows non‑Camel‑prefixed Exchange headers to bypass the HeaderFilterStrategy and override CouchDB operations via untrusted input. This flaw means an attacker who can influence headers in a Camel route can manipulate the commands sent to CouchDB, threatening the integrity of stored data. The weakness is categorized as CWE-20.

The vulnerability affects Apache Camel version 4.14.7 and earlier, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.0 when the CouchDB component is used. Versions 4.14.8, 4.18.3, 4.21.0 and later contain the fix.

The CVSS score of 7.3 indicates a high severity risk. The EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to involve supplying malicious headers to a Camel route that interacts with CouchDB. An attacker would need to have nominal access to the Camel instance and ability to set headers, which could allow operation override against the underlying database.