CVE-2026-40453 - Vulnerability Analysis

Overview

Apache Camel 3.0.0 < 4.14.6, 4.15.0 < 4.18.2, 4.19.0 < 4.20.0 contains a remote code execution caused by case-sensitive header filtering in non-HTTP HeaderFilterStrategy implementations, letting attackers with JMS producer access execute code and write files remotely, exploit requires JMS producer access.

Severity & Score

Impact

Attackers with JMS producer access can execute arbitrary code and write files remotely, leading to full system compromise.

Mitigation

Upgrade to versions 4.14.6, 4.18.2, or 4.20.0 depending on your release stream.

References

• https://camel.apache.org/security/CVE-2026-40453.html

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 27, 2026

🔴 CVE-2026-40453 - Critical (9.9) The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was no... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40453/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner