The vulnerability arises from improper input validation in Apache Camel’s saga processor, which uses a Long-Running-Action header to associate messages with sagas. Because the header lacks the Camel namespace prefix, consumer header filters do not block it, allowing an external sender to supply a forged header on inbound messages. The attacker can then make a message participate in an existing saga or link a compensation action to an action they did not initiate, effectively hijacking the saga lifecycle and potentially corrupting the business process. This flaw is a classic example of CWE-20 (Improper Input Validation).

The issue affects Apache Camel versions 4.0.0 through 4.18.4, 4.19.0 through 4.21.x, and 4.22.0 through 4.22.0, as stated in the advisory. The affected component is the Camel Core saga processor. Users of the 4.18.x LTS stream are advised to upgrade to 4.18.5, 4.22.x to 4.22.1, and patch to 4.23.0 or later.

The CVSS score of 4.8 indicates moderate risk, and the EPSS score is not available, suggesting a low-to-moderate probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending a message to a Camel route that processes sagas; the attacker would inject the Long-Running-Action header at the edge of the system. There are no explicit authentication or privilege requirements beyond the ability to send messages to the Camel endpoint.