Apache Camel’s JIRA component reads JIRA operation parameters from Exchange headers that lack the required Camel prefix. The HttpHeaderFilterStrategy blocks only headers in the Camel namespace, so these non‑prefixed headers bypass the filter and are transmitted to the Jira producer. This flaw enables an external HTTP client to set values such as IssueKey, ProjectKey, and IssueTransitionId without needing authentication, causing the component to execute those operations under the service‑account credentials configured on the endpoint. The result is unauthorized creation, deletion, modification, or transition of Jira issues, limited only by the permissions of the service account.

The vulnerability affects the Apache Camel JIRA component across multiple release streams. All versions from 4.0.0 up to but not including 4.14.8 in the 4.0.x line, from 4.15.0 up to but not including 4.18.3 in the 4.15.x stream, and from 4.19.0 up to but not including 4.21.0 in the 4.19.x stream are susceptible. Users running any of these releases should verify their version and plan an upgrade to the patched releases 4.14.8, 4.18.3, or 4.21.0 respectively.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low current exploitation probability. However, the vulnerability requires no attacker credentials and can be triggered via a simple HTTP request to an exposed Camel route, giving attackers control over JIRA operations within the scope of the configured service account. Since the vulnerability is listed as not in the CISA KEV catalog, there is no confirmed exploitation in the wild, but the potential for internal abuse or future remote exploitation remains, warranting prompt remediation.