Exploit for CVE-2026-49099

kitploit · 2026-08-25

Entry point

ParametersObjectQuery · header

Pathplatform-http:/contacts

Header-over-config precedence allows attacker to override SOQL query via sObjectQuery header.

Affected Apache Camel versions

Apache Camel< 4.14.8, 4.18.3, 4.21.0

All known vulnerabilities by product

Apache Camel Salesforce

CVSS 5.3 for CVE-2026-49099

5.3

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:LOW

Integrity:NONE

Availability:NONE

CVE Information

CVE-2026-49099

Exploit Details

Modified:2026-08-25 04:30

Last Seen:2026-08-25 20:35

Reporter:KitPloit

Other exploits for CVE-2026-49099

CVE-2026-49099 — Updated!

2026-07-30 KitPloitKITPLOIT

Exploit for Authorization Bypass Through User-Controlled Key in Apache Camel

2026-07-21 oscerdGITHUB

CVE-2026-49099

2026-07-06 apacheUNKNOWN

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-49099
# CVE-2026-49099 — camel-salesforce `sObjectQuery` Header Injection

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Exploit Code

Share

Share on social media: