Description
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.



This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.



The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.
Published: 2026-10-19
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Expression Language Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability originates in the dynamic‑router‑control endpoint introduced in Camel 4.4.0. When a subscribe or update message is received, the endpoint extracts a predicate expression and the language name directly from the message’s body or headers, compiles that expression with no allow‑list or opt‑in, and injects it into the rule base that is evaluated against every exchange routed through the dynamic router. This design flaw permits arbitrary code execution via expression‑language injection (CWE‑94) or code injection (CWE‑917). An attacker who can send a message to any transport whose route forwards to the dynamic‑router control endpoint can supply a malicious expression; no additional authentication or user interaction is required.

Affected Systems

Apache Camel versions 4.4.0 through 4.18.4 and 4.19.0 through 4.22.0 are affected. The issue does not exist in releases prior to 4.4.0. Support for 4.14.x and earlier ended before the fix, so any deployment still on those branches must move to a supported release. The patch is available in Camel 4.18.5, 4.22.1, and 4.23.0, which introduce the allowPredicateFromMessage option and related security metadata.

Risk and Exploitability

The CVSS base score is 8.8, indicating high severity. EPSS is not available, but the vulnerability can be exploited by any actor able to write to a transport that forwards to the control endpoint, so the risk is significant in environments where such transports are exposed to untrusted or shared traffic. The issue is not listed in CISA’s KEV, yet urgent remediation is advised, especially because the attacker requires no credentials and the compromise would execute within the Camel process with full privileges.

Generated by OpenCVE AI on October 19, 2026 at 11:39 UTC.

Remediation

Vendor Solution

Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. A new allowPredicateFromMessage option on the dynamic-router-control endpoint, defaulting to false, now decides whether the subscription predicate and its expression language may be taken from a control message. When it is false, a subscribe or update request whose DynamicRouterControlMessage body or headers carry a predicate expression or an expression language is rejected with an IllegalArgumentException, and the predicate and expressionLanguage configured on the endpoint are used instead. The option is not mapped from any message header, and the toD optimisation keeps it on the endpoint URI, so only the route author can enable it. The header form of a control message now also falls back to the endpoint configuration for parameters the message does not carry, so a subscription can be declared entirely on a static endpoint URI. Subscriptions that reference a predicate bean from the registry, or that pass a Predicate instance in the message body, are unchanged. On 4.23.0 and 4.22.1 the option is additionally marked as an insecure:dev security option, so the security policy framework treats an endpoint that enables it as insecure, which fails by default when camel.main.profile is set to prod, and the dynamic-router endpoint gains an allowedSchemes option, unset by default, that restricts which endpoint schemes a subscription's destinationUri may use. The 4.18.5 release carries the allowPredicateFromMessage option only, because the security-option metadata and the recipient-list scheme allow-list that the other two releases build on are not present on that maintenance line.

Vendor Workaround

For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to 4.23.0 (or 4.22.1 if on the 4.22.x stream, or 4.18.5 if on the 4.18.x stream). The new versions disable predicate compilation from messages by default; enable allowPredicateFromMessage only when all control‑message senders are trusted.
  • In the interim, block or restrict transports that forward external messages to the dynamic‑router‑control endpoint; limit sending to trusted sources only.
  • When control messages must cross an untrusted transport, authenticate the sender and ensure that the predicate and expression language are specified by the route, not supplied by the message – for example, strip CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clear the predicate and expressionLanguage fields before the message reaches the endpoint.
  • If using Camel 4.22+ or 4.23+, configure the allowedSchemes option on the dynamic‑router endpoint to restrict which destination URIs a subscription can name, adding an extra layer of protection.

Generated by OpenCVE AI on October 19, 2026 at 11:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Camel
Apache camel
Vendors & Products Apache
Apache apache Camel
Apache camel

Mon, 19 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The dynamic-router-control endpoint, introduced in 4.4.0, lets routing participants manage Dynamic Router subscriptions by sending control messages. When it handled a subscribe or update request, DynamicRouterControlProducer took the subscription predicate and the name of the language used to compile it from the incoming message, either from the predicate and expressionLanguage fields of a DynamicRouterControlMessage body or from the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers. DynamicRouterControlService then resolved that language from the CamelContext and compiled the expression into a Predicate, with no allow-list and no opt-in. The compiled predicate was added to the channel's rule base and evaluated against every exchange routed through the corresponding dynamic-router endpoint for as long as the subscription existed. A route that forwards messages from an external transport to the control endpoint, as shown in the component documentation for routing participants in other JVMs or applications, therefore let any actor able to send a message on that transport supply an expression of their choosing, which was evaluated with the privileges of the Camel process. Any expression language available on the classpath could be selected, including the simple language, which is always present and was the default on the header path, so removing optional expression languages from the classpath did not prevent the issue. Exploitation requires the ability to send a message on a transport whose route forwards it to a dynamic-router-control endpoint; no other authentication or user interaction is needed. Releases before 4.4.0 are not affected, because their control channel took predicate expressions only from the endpoint URI configured by the route author. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.
Title Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
Weaknesses CWE-917
CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Apache Apache Camel Camel
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T17:01:22.779Z

Reserved: 2026-08-31T16:32:43.348Z

Link: CVE-2026-83531

cve-icon Vulnrichment

Updated: 2026-10-19T17:01:14.686Z

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:21.507

Modified: 2026-10-19T17:17:22.930

Link: CVE-2026-83531

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:30:13Z

Weaknesses
  • CWE-917

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')