CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
Improper Input Validation vulnerability in Apache Camel Core component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits outside the namespace that consumer header filters block, and an external sender could supply it on an inbound message. That let the sender name the saga the exchange joined, attaching their request to a long-running action started by someone else, or causing compensation to be associated with an action they did not initiate. The header is only consulted by a saga service that uses it, which bounds the exposure to deployments running sagas over an LRA coordinator.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The header is now consulted only for a saga service that actually uses it, rather than on every exchange. For deployments that cannot upgrade immediately, strip the header at the trust boundary with removeHeaders("Long-Running-Action") on every consumer that accepts messages from an untrusted sender.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Configuration
For deployments that cannot upgrade immediately, strip the Long-Running-Action header at the trust boundary on every consumer that accepts messages from an untrusted sender.
Apache Camel consumers removeHeaders("Long-Running-Action") = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure is limited to deployments that run Camel sagas using an LRA coordinator. The affected header is only relevant when a saga service uses it.
What does an attacker need to exploit this issue?
An external sender must be able to supply the Long-Running-Action header on an inbound message. Because the header lacks a Camel prefix, consumer header filters do not block it.
What can happen if the header is accepted?
An attacker can cause an exchange to join a long-running action started by someone else, or associate compensation with an action they did not initiate. The stated impact is limited to confidentiality and integrity.
What should be done if an upgrade cannot be applied immediately?
Strip the Long-Running-Action header at the trust boundary, such as with removeHeaders("Long-Running-Action"). Upgrade to Camel 4.23.0 when possible; supported affected LTS streams should use 4.18.5 or 4.22.1.