Improper input validation in the Apache Camel Vertx WebSocket component causes inbound WebSocket query and path parameters to be mapped directly into the Camel Exchange header map without a HeaderFilterStrategy, allowing an attacker to inject Camel‑internal control headers such as CamelHttpUri through query parameters; when the consumer feeds a downstream HTTP producer, the injected CamelHttpUri redirects the server‑side HTTP request to an attacker‑chosen destination, enabling SSRF to internal services or cloud metadata endpoints, and the HTTP producer resolves property placeholders in the attacker‑controlled URI, exposing environment variables, application properties, and vault secrets; this can be performed by an unauthenticated remote attacker accessing the WebSocket endpoint, leading to confidentiality and integrity compromise as described by CWE‑20, CWE‑200, and CWE‑918.

Affected systems include the Apache Camel Vertx WebSocket component from the Apache Software Foundation. Versions prior to 4.14.8 in the 4.0.0‑4.13.x stream, prior to 4.18.3 in the 4.15.0‑4.17.x stream, and prior to 4.21.0 in the 4.19.0‑4.20.x stream are vulnerable. Versions 4.14.8, 4.18.3, 4.21.0, and later contain the fix.

The vulnerability has a CVSS score of 7.5, indicating a high severity risk to confidentiality, integrity, and availability; the EPSS score of less than 1% indicates that automated exploitation is unlikely but possible; it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote unauthenticated access to the WebSocket endpoint, as the description notes that the endpoint is exposed without authentication; the attacker simply supplies malicious query or path parameters to inject Camel control headers which then cause SSRF and potential disclosure of sensitive configuration data.