Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-48204.
Upgrade to ProDetect Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204) in Microsoft Sentinel
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion Impact
KQL Detection Query
let SuspiciousHeaders = dynamic(["gridfs.operation", "gridfs.query", "gridfs.filter", "gridfs.$where", "gridfs.delete", "gridfs.remove"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsHost has "camel" or CsUriStem has "gridfs" or CsUriStem has "camel"
| extend HeaderMatches = extract_all(@"(?i)(gridfs\.[a-zA-Z\$]+)\s*[:=]", RequestHeaders)
| where array_length(HeaderMatches) > 0 or RequestHeaders has "$where" or RequestHeaders has "$ne" or RequestHeaders has "$gt" or RequestHeaders has "$regex"
| project TimeGenerated, CIp, CsHost, CsUriStem, RequestHeaders, HeaderMatches, ScStatus
| order by TimeGenerated descFlags inbound HTTP requests to Camel-fronted endpoints that carry gridfs.* headers or MongoDB NoSQL operators ($where, $ne, $gt, $regex) which could override GridFS producer operations or inject query operators against camel-mongodb-gridfs.
Data Sources
Required Tables
False Positives & Tuning
- Internal automated test suites sending crafted gridfs.* headers during CI integration tests
- Legitimate GridFS management tooling that intentionally sets gridfs.operation headers
- Security scanners/pentest tooling probing the same headers as part of authorized assessments
Other platforms for CVE-2026-48204
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1GridFS Operation Override via Header Injection
Expected signal: HTTP access log entry showing the gridfs.operation header; MongoDB profiler entry for a delete operation against fs.files/fs.chunks that was not expected for an upload request.
- Test 2NoSQL Operator Injection via gridfs.query Header
Expected signal: HTTP request log with gridfs.query header containing $where; MongoDB profiler log showing a find operation using an unexpected $where clause.
- Test 3Bulk GridFS Listing via listAll Override
Expected signal: HTTP access log entry showing gridfs.operation=listAll on an endpoint intended for scoped reads; MongoDB profiler entry showing a broad find/list query against fs.files.
References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-48204
- https://camel.apache.org/security/CVE-2026-48204.html
- http://www.openwall.com/lists/oss-security/2026/07/05/18
- https://github.com/apache/camel/commit/8f0b1acfb89867bc28805d8281fa5c70192e2122
- https://issues.apache.org/jira/browse/CAMEL-23575
- https://github.com/advisories/GHSA-f7g3-2cg6-f5hj
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-48204 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month