Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-48204.
Upgrade to ProDetect Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204) in Google Chronicle
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion Impact
YARA-L Detection Query
rule camel_mongodb_gridfs_header_injection {
meta:
author = "df00tech"
description = "Detects gridfs.* header injection / NoSQL operator abuse against camel-mongodb-gridfs (CVE-2026-48204)"
severity = "CRITICAL"
events:
$http.metadata.event_type = "NETWORK_HTTP"
$http.network.http.method != ""
(
re.regex($http.target.url, `(?i)gridfs`) or
re.regex($http.network.http.request_headers, `(?i)gridfs\.[a-zA-Z\$]+`)
)
re.regex($http.network.http.request_headers, `(?i)\$where|\$ne|\$gt|\$regex`)
condition:
$http
}Chronicle YARA-L rule matching HTTP requests to GridFS-related endpoints where request headers contain gridfs.* keys alongside MongoDB NoSQL query operators, indicative of CVE-2026-48204 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Internal test harnesses that legitimately set gridfs.operation headers
- CI/CD pipelines exercising GridFS integration tests
- Authorized security assessment traffic
Other platforms for CVE-2026-48204
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1GridFS Operation Override via Header Injection
Expected signal: HTTP access log entry showing the gridfs.operation header; MongoDB profiler entry for a delete operation against fs.files/fs.chunks that was not expected for an upload request.
- Test 2NoSQL Operator Injection via gridfs.query Header
Expected signal: HTTP request log with gridfs.query header containing $where; MongoDB profiler log showing a find operation using an unexpected $where clause.
- Test 3Bulk GridFS Listing via listAll Override
Expected signal: HTTP access log entry showing gridfs.operation=listAll on an endpoint intended for scoped reads; MongoDB profiler entry showing a broad find/list query against fs.files.
References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-48204
- https://camel.apache.org/security/CVE-2026-48204.html
- http://www.openwall.com/lists/oss-security/2026/07/05/18
- https://github.com/apache/camel/commit/8f0b1acfb89867bc28805d8281fa5c70192e2122
- https://issues.apache.org/jira/browse/CAMEL-23575
- https://github.com/advisories/GHSA-f7g3-2cg6-f5hj
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-48204 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month