Exploit for CVE-2026-49042

kitploit · 2026-08-25

Entry point

ParameterCamelExecCommandExecutable · header

Path/chat

Prompt-injected tool-call arguments can be promoted to Camel headers, enabling control over downstream components (e.g., RCE/SSRF/file writes).

Affected Apache Camel versions

Apache Camel< 4.18.3, 4.21.0

All known vulnerabilities by product

Apache Camel

CVSS 7.3 for CVE-2026-49042

7.3

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:LOW

Integrity:LOW

Availability:LOW

CVE Information

CVE-2026-49042

Exploit Details

Modified:2026-08-25 04:30

Last Seen:2026-08-25 20:34

Reporter:KitPloit

Other exploits for CVE-2026-49042

CVE-2026-49042 — Updated!

2026-07-31 KitPloitKITPLOIT

Exploit for Improper Input Validation in Apache Camel

2026-07-20 oscerdGITHUB

CVE-2026-49042

2026-07-06 apacheUNKNOWN

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-49042
# CVE-2026-49042 — camel-langchain4j-tools Prompt-Injection → Header-Injection

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Exploit Code

Share

Share on social media: