https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 02:48:05 +0000 https://vulnerability.circl.lu/vuln/cve-2026-49086 <p><strong>Affected:</strong> Apache Software Foundation Apache Camel Dapr</p> <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Camel Dapr</p> <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> https://vulnerability.circl.lu/vuln/cve-2026-49086