Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-48204.
Upgrade to ProDetect Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204) in Splunk
Detects exploitation attempts against CVE-2026-48204, a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. Affected versions (>=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0) fail to filter caller-supplied gridfs.* HTTP/Camel exchange headers before applying them to GridFS producer operations, allowing an attacker to override the intended GridFS operation (e.g. force a delete/listAll/findOne instead of the intended write) and inject NoSQL query operators into MongoDB GridFS filter queries. This can lead to unauthorized data disclosure, deletion of stored files, or NoSQL injection against the backing MongoDB metadata collection. A public PoC/advisory exists (GHSA-f7g3-2cg6-f5hj).
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion Impact
SPL Detection Query
index=web_proxy OR index=app_logs sourcetype=camel_http
| rex field=_raw "(?i)(?<gridfs_header>gridfs\.[a-zA-Z\$]+)\s*[:=]\s*(?<gridfs_value>[^\r\n&]+)"
| where isnotnull(gridfs_header) OR match(_raw, "(?i)\$where|\$ne|\$gt|\$regex")
| eval nosql_operator_hit=if(match(_raw, "(?i)\$where|\$ne|\$gt|\$regex"), "yes", "no")
| table _time, src_ip, dest_ip, uri_path, gridfs_header, gridfs_value, nosql_operator_hit, status
| sort -_timeSearches proxy/application logs for camel-mongodb-gridfs endpoints receiving gridfs.* headers or embedded MongoDB NoSQL query operators indicative of GridFS operation override or NoSQL injection attempts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate internal microservice calls that pass gridfs.operation headers by design
- QA/staging environment traffic exercising GridFS CRUD test cases
- Vulnerability scanning tools authorized to probe the endpoint
Other platforms for CVE-2026-48204
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1GridFS Operation Override via Header Injection
Expected signal: HTTP access log entry showing the gridfs.operation header; MongoDB profiler entry for a delete operation against fs.files/fs.chunks that was not expected for an upload request.
- Test 2NoSQL Operator Injection via gridfs.query Header
Expected signal: HTTP request log with gridfs.query header containing $where; MongoDB profiler log showing a find operation using an unexpected $where clause.
- Test 3Bulk GridFS Listing via listAll Override
Expected signal: HTTP access log entry showing gridfs.operation=listAll on an endpoint intended for scoped reads; MongoDB profiler entry showing a broad find/list query against fs.files.
References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-48204
- https://camel.apache.org/security/CVE-2026-48204.html
- http://www.openwall.com/lists/oss-security/2026/07/05/18
- https://github.com/apache/camel/commit/8f0b1acfb89867bc28805d8281fa5c70192e2122
- https://issues.apache.org/jira/browse/CAMEL-23575
- https://github.com/advisories/GHSA-f7g3-2cg6-f5hj
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-48204 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month