CVE-2026-33453

published 2026-04-27

CVE-2026-33453: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap…

Priority P1 82 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

EXPLOIT

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.

Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec)

The camel-coap component maps incoming CoAP request URI query parameters directly into Camel Exchange In message headers without applying any HeaderFilterStrategy.
Specifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery() and calls camelExchange.getIn().setHeader(...) for every query parameter. CoAPEndpoint extends DefaultEndpoint rather than DefaultHeaderFilterStrategyEndpoint, and CoAPComponent does not implement HeaderFilterStrategyComponent; the component contains no references to HeaderFilterStrategy at all.

As a result, an unauthenticated attacker who can send a single CoAP UDP packet to a Camel route consuming from coap:// can inject arbitrary Camel internal headers (those prefixed with Camel*) into the Exchange. When the route delivers the message to a header-sensitive producer such as camel-exec, camel-sql, camel-bean, camel-file, or template components (camel-freemarker, camel-velocity), the injected headers can alter the producer's behavior. In the case of camel-exec, the CamelExecCommandExecutable and CamelExecCommandArgs headers override the executable and arguments configured on the endpoint, resulting in arbitrary OS command execution under the privileges of the Camel process.

The producer's output is written back to the Exchange body and returned in the CoAP response payload by CamelCoapResource, giving the attacker an interactive RCE channel without any need for out-of-band exfiltration.

Exploitation prerequisites are minimal: a single unauthenticated UDP datagram to the CoAP port (default 5683). CoAP (RFC 7252) has no built-in authentication, and DTLS is optional and disabled by default. Bec

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apache	camel	—	—
apache	camel	—	—
apache	camel	4.14.0 – 4.14.5	—
apache_software_foundation	apache_camel	—	—
apache_software_foundation	apache_camel	4.14.0 – 4.14.5	—
apache_software_foundation	apache_camel	>= 4.18.0 < 4.18.1	4.18.1

Detection & IOCs extracted from sources · hover to see the quote

port 5683/udp↗

command CamelExecCommandExecutable=/bin/sh

command CamelExecCommandArgs=-c 'echo <marker>'

other shodan: port:5683

other fofa: protocol="coap"

• → Monitor for CoAP UDP packets on port 5683 containing URI query parameters with 'Camel*' prefixed header names (e.g. CamelExecCommandExecutable, CamelExecCommandArgs), which indicate header injection attempts against camel-coap routes. ↗
• → Alert on CoAP URI query parameters containing 'CamelExecCommandExecutable' or 'CamelExecCommandArgs', as these directly override the executable and arguments in camel-exec producers, enabling arbitrary OS command execution. ↗
• → Because the attack is UDP-based CoAP, HTTP-layer WAF/IDS controls will not detect or block exploitation; network monitoring must inspect UDP/5683 traffic directly. ↗
• → Look for unexpected process spawns (e.g. /bin/sh) originating from the Camel JVM process, which may indicate successful exploitation via injected CamelExecCommandExecutable headers. ↗
• → The PoC nuclei template matches response payloads containing the string 'VULNERABLE|' followed by 'CVE202633453'; monitor CoAP response payloads for these strings as indicators of active scanning.
• → Inspect CamelCoapResource.handleRequest() call sites: if OptionSet.getUriQuery() results are passed directly to camelExchange.getIn().setHeader() without HeaderFilterStrategy filtering, the endpoint is vulnerable. ↗

• · DTLS (transport-layer security for CoAP) is optional and disabled by default, meaning most deployments expose the CoAP port without authentication, making exploitation trivial from any network-reachable host. ↗
• · Exploitation only results in RCE if the Camel route forwards CoAP messages to a header-sensitive producer (camel-exec, camel-sql, camel-bean, camel-file, camel-freemarker, camel-velocity); routes not using such producers are not directly exploitable for RCE but are still vulnerable to header injection. ↗
• · Affected versions are Apache Camel 4.14.0 through 4.14.5, 4.18.0 (before 4.18.1), and 4.19.0. Red Hat package 'apache-camel' (Red Hat Fuse 7) and 'camel-coap' (Red Hat Fuse 7) and 'camel-coap-starter' (Red Hat Fuse 7) are listed as Not Affected. ↗

CVSS provenance

nvd v3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-915