## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-49086
# camel-dapr Consumer Routing-Header Override / Confused Deputy Reproducer (CVE-2026-49086)
This project demonstrates a **routing-header override (confused-deputy)** flaw in Apache Camel's `camel-dapr` component, tracked as **CVE-2026-49086**.
The Dapr pub/sub **consumer** (`DaprPubSubConsumer`) copies fields of the inbound (untrusted) CloudEvent into Exchange message headers. Two of those — `pubsubName` and `topic` — are **producer-direction routing headers** (`CamelDaprPubSubName` / `CamelDaprTopic`). When the same route later publishes with a `dapr:pubSub` **producer** , `DaprConfigurationOptionsProxy` . So the inbound envelope, which an untrusted message sender controls, silently overrides where the route republishes: