Exploit for CVE-2026-46592

kitploit · 2026-08-25

Entry point

ParameteroperationName · header

Pathlocalhost:9000/account

HTTP header-based operation selection in CXF producer can be overridden to invoke a different SOAP operation.

Affected Apache Camel versions

Apache Camel< 4.14.8, 4.18.3, 4.21.0

All known vulnerabilities by product

Apache Camel

CVSS 7.5 for CVE-2026-46592

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

CVE Information

CVE-2026-46592

Exploit Details

Modified:2026-08-25 04:24

Last Seen:2026-08-25 20:14

Reporter:KitPloit

Other exploits for CVE-2026-46592

Exploit for Confused Deputy in Apache Camel

2026-07-16 oscerdGITHUB

CVE-2026-46592

2026-07-06 apacheUNKNOWN

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-46592
# CVE-2026-46592 — camel-cxf `operationName` Header Injection (SOAP Operation Redirection)

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Exploit Code

Share

Share on social media: