Apache Camel Salesforce is susceptible to header injection that allows an attacker to supply arbitrary SOQL queries, SOSL searches, or Apex REST calls by setting non‑Camel‑prefixed Exchange header constants. Because the HTTP header filter only blocks Camel‑prefixed headers, these values bypass the filter and are read as operation parameters by the camel‑salesforce producer. The injected parameters run with the full permissions of the connected Salesforce user, allowing modification, deletion, or data exfiltration without requiring credentials from the attacker.

Apache Camel Salesforce component versions from 4.0.0 up to but not including 4.14.8, from 4.15.0 up to but not including 4.18.3, and from 4.19.0 up to but not including 4.21.0 are affected. Affected deployments include routes that bridge an HTTP consumer (e.g., platform-http) into a salesforce: producer where Exchange header constants are used for Salesforce operation parameters.

Based on the description, the attacker can send crafted HTTP requests that contain the non‑Camel‑prefixed header constants. The likely attack vector is a remotely‑triggered HTTP request to the bridging consumer, such as an unprotected platform‑http endpoint, which bypasses the HTTP header filter and injects arbitrary Salesforce operation parameters. The EPSS score is less than 1%, indicating a low probability of exploitation, yet the vulnerability permits the injected operations to run with the full permissions of the connected Salesforce user, meaning that data exfiltration, modification, or destructive actions are possible without requiring attacker credentials. The CVE is not listed in the CISA KEV catalog, and the CVSS score of 5.3 suggests medium severity.