Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-48204.
Upgrade to ProDetect Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204) in IBM QRadar
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion Impact
QRadar Detection Query
SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, URL, payload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%HTTP%'
AND (payload ILIKE '%gridfs.operation%' OR payload ILIKE '%gridfs.query%' OR payload ILIKE '%gridfs.filter%')
AND (payload ILIKE '%$where%' OR payload ILIKE '%$ne%' OR payload ILIKE '%$gt%' OR payload ILIKE '%$regex%')
LAST 24 HOURSIdentifies QRadar-normalized HTTP events referencing gridfs.* headers together with MongoDB NoSQL operators, indicating potential exploitation of the camel-mongodb-gridfs header injection vulnerability.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate application logic that forwards gridfs.operation headers by design
- Internal QA regression suites exercising GridFS query edge cases
- Authorized penetration test traffic targeting the same endpoints
Other platforms for CVE-2026-48204
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1GridFS Operation Override via Header Injection
Expected signal: HTTP access log entry showing the gridfs.operation header; MongoDB profiler entry for a delete operation against fs.files/fs.chunks that was not expected for an upload request.
- Test 2NoSQL Operator Injection via gridfs.query Header
Expected signal: HTTP request log with gridfs.query header containing $where; MongoDB profiler log showing a find operation using an unexpected $where clause.
- Test 3Bulk GridFS Listing via listAll Override
Expected signal: HTTP access log entry showing gridfs.operation=listAll on an endpoint intended for scoped reads; MongoDB profiler entry showing a broad find/list query against fs.files.
References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-48204
- https://camel.apache.org/security/CVE-2026-48204.html
- http://www.openwall.com/lists/oss-security/2026/07/05/18
- https://github.com/apache/camel/commit/8f0b1acfb89867bc28805d8281fa5c70192e2122
- https://issues.apache.org/jira/browse/CAMEL-23575
- https://github.com/advisories/GHSA-f7g3-2cg6-f5hj
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-48204 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month