CVE-2026-46584: Apache Camel-Mail Vulnerability in Mail Producer Handling of SMTP Headers
Summary
CVE-2026-46584: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. Affects org.apache.camel:camel-mail across 3 version ranges.
>= 4.0.0, < 4.14.8
>= 4.15.0, < 4.18.3
>= 4.19.0, < 4.21.0
Fixed in 4.14.8, 4.18.3 or 4.21.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that enables developers to integrate various applications using a wide range of protocols and technologies. The Camel-Mail component specifically facilitates sending and receiving emails through SMTP and other mail protocols. It allows users to configure email settings and manage email exchanges seamlessly. However, a vulnerability has been identified in the Camel-Mail component that can lead to improper handling of attacker-supplied SMTP headers, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from improper input validation in the Apache Camel Mail Component, specifically within the MailProducer class. The mail producer scans outgoing messages for headers in the mail.smtp and mail.smtps namespaces. If these headers are present, they are applied as JavaMail session properties, overriding the endpoint configuration. This behavior allows untrusted input to influence the mail sending process, leading to potential redirection of SMTP connections to an attacker's server or weakening transport security. The severity of the impact varies based on the version of Apache Camel in use, with earlier versions being more susceptible to credential exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.14.84.14.8 -
>= 4.15.0, < 4.18.34.18.3 -
>= 4.19.0, < 4.21.04.21.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, users can implement a workaround by stripping the vulnerable header namespace before the mail producer. This can be achieved by adding the following code in the route configuration:
removeHeaders('mail.smtp.') removeHeaders('mail.smtps.')
Conclusion
In summary, CVE-2026-46584 is a significant vulnerability in the Apache Camel-Mail component that can lead to the exposure of sensitive information through improper handling of SMTP headers. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk. For those unable to upgrade immediately, a workaround is available to help secure their applications.
See every vulnerability recorded for org.apache.camel:camel-mail →
FAQ
CVE-2026-46584 is a vulnerability in the Apache Camel-Mail component that allows attacker-supplied SMTP headers to be applied as session properties, potentially leading to sensitive information exposure.
The vulnerability affects Apache Camel versions from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, and from 4.19.0 before 4.21.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot upgrade immediately, implement the workaround by stripping the vulnerable header namespace using the removeHeaders function in your route configuration.
The CVSS score for CVE-2026-46584 is 3.7, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-mail.
