External risk intelligence

Apache Camel DNS SSRF Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-48205

The vulnerability requires a specific, non-default configuration where an Apache Camel route bridges an HTTP consumer directly to a DNS producer. While reachable via network, it only exists if a developer explicitly exposes internal DNS operations to untrusted inbound HTTP requests.

Server-Side Request Forgery

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Apache Camel's DNS component that could allow an attacker to manipulate DNS lookups. This occurs when specific message headers are not properly validated, potentially enabling them to reroute DNS queries to attacker-controlled servers and discover internal hostnames.

Unvalidated headers can alter DNS lookups.
Internal network reconnaissance is possible.
Confirm relevance and exposure; specific configuration needed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to an exposed Apache Camel application. If the application's route bridges an HTTP consumer to a DNS producer, the attacker can manipulate message headers to redirect DNS lookups to an attacker-controlled server. This allows the attacker to observe DNS queries for internal hostnames and potentially receive falsified DNS responses.

Unauthenticated HTTP access required.
Manipulate DNS headers in HTTP requests.
Internal reconnaissance and DNS poisoning.

Live Threat

Current exploitation, exposure, and threat context

When Apache Camel's DNS component is configured to bridge an HTTP consumer with a DNS producer, unauthenticated HTTP clients could potentially trick the system into querying attacker-controlled DNS servers. This could lead to the disclosure of whether internal hostnames exist within a network.

Internal hostnames and DNS server behavior.
Via specially crafted HTTP requests to specific routes.
Network reconnaissance and potential DNS poisoning.

Operational Fix

Recommended remediation, mitigation, and detection steps

System administrators and platform teams responsible for managing Apache Camel deployments should prioritize assessing the impact of this vulnerability. The immediate practical step is to identify all instances of the affected Apache Camel DNS component, determine their exposure to untrusted network traffic, and confirm the business criticality of these components. Once identified and prioritized, work with application owners to plan and execute remediation.

Platform and application owners should own remediation.
Verify exposure of DNS component to untrusted ingress.
Plan upgrade or implement header filtering controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Apache Camel DNS component?

Apache Camel is an integration framework used to connect different software systems by routing data between them. The DNS component is a specific plugin that allows developers to perform network lookups, such as resolving hostnames to IP addresses or querying specific DNS servers, directly within their integration workflows.

What does CVE-2026-48205 mean for security?

This CVE involves Improper Input Validation and Server-Side Request Forgery (SSRF). Because the software does not properly filter certain message headers, an attacker can trick the system into performing DNS queries against an attacker-controlled server. This allows them to observe what the application is looking up and potentially feed it falsified information.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted HTTP request to an application that bridges an HTTP consumer directly to a DNS producer. The bug is not triggered if the application does not connect these two specific components or if the HTTP request is not bridged to the DNS producer. It requires the route to forward these unfiltered headers from the HTTP boundary to the DNS lookup logic.

Is my system relevant according to Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is only possible if your application is specifically configured to bridge an HTTP consumer directly to a DNS producer. While the threat is reachable over the network, it does not affect all Apache Camel installations; it is limited to scenarios where a developer has explicitly exposed internal DNS operations to untrusted inbound HTTP traffic.

What are the first steps to handle CVE-2026-48205?

First, identify if any of your Apache Camel routes bridge inbound HTTP traffic to the DNS component. If you find such routes, prioritize upgrading to the recommended patched version of Apache Camel. If you cannot update immediately, you must modify your routes to strip the vulnerable 'dns.*' and 'term' headers from all untrusted incoming requests and set the DNS parameters using trusted internal values instead.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.