https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:23:00 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10162 bdu:2026-10162 https://cve.radiocsirt.org/vuln/bdu:2026-10162 https://cve.radiocsirt.org/vuln/euvd-2026-333498 EUVD-2026-333498 https://cve.radiocsirt.org/vuln/euvd-2026-333498 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49086 <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49086 https://cve.radiocsirt.org/vuln/ghsa-583r-f84w-33g7 <p><strong>Affected:</strong> Maven: org.apache.camel:camel-dapr</p> <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> <p><strong>Affected:</strong> Maven: org.apache.camel:camel-dapr</p> <p>Improper Input Validation, Unintended Proxy or Intermediary (&#39;Confused Deputy&#39;) vulnerability in Apache Camel DAPR component.</p> <p>The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back and prefers them over the destination configured on the endpoint. As a result, in a route that consumes from one Dapr Pub/Sub topic and republishes to another (for example from(&#39;dapr-pubsub:p:t&#39;).to(&#39;dapr-pubsub:p:other&#39;)), an actor able to publish a message to the subscribed topic could set the CloudEvent&#39;s pub/sub-name and topic to values of their choosing and cause the re-published message to be delivered to an arbitrary Dapr Pub/Sub component and topic instead of the configured destination - redirecting or exfiltrating the message and bypassing the route&#39;s intended routing and any topic-level access controls in the underlying broker. Exploitation requires the ability to publish to the topic the route subscribes to; no other authentication or user interaction is needed. This issue affects Apache Camel: from 4.12.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.</p> <p>Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x…</p> https://cve.radiocsirt.org/vuln/ghsa-583r-f84w-33g7 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2203 <p>Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2203