CVE-2026-71300 IBM QRadar · QRadar

Detect Apache Camel-Atmosphere-Websocket WebSocket Dispatch Header Injection (CVE-2026-71300) in IBM QRadar

Detects exploitation attempts and vulnerable deployments of Apache Camel camel-atmosphere-websocket affected by CVE-2026-71300 (CVSS 9.8, CWE-20). The camel-atmosphere-websocket producer selected its target WebSocket peers using Exchange header values whose header names fell OUTSIDE the filtered Camel header namespace. Because these attacker-controllable HTTP/message headers were not stripped by the Camel header filter strategy, a remote attacker able to influence inbound headers can inject dispatch-control headers (e.g. sendToAll / connection-key style targeting) and redirect, broadcast, or spoof WebSocket messages to arbitrary connected peers. This detection surfaces HTTP requests carrying anomalous WebSocket dispatch headers, Camel routes logging unfiltered header propagation, and the presence of affected artifact versions (>= 4.0.0 < 4.14.9, >= 4.15.0 < 4.18.4, >= 4.19.0 < 4.22.0).

MITRE ATT&CK

Tactic
Initial Access Lateral Movement

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, url, "Request Headers" AS headers, QIDNAME(qid) AS event, starttime
FROM events
WHERE (LOWER(url) LIKE '%camel%' OR LOWER(url) LIKE '%websocket%' OR LOWER(url) LIKE '%atmosphere%')
AND ("Request Headers" ILIKE '%sendToAll%' OR "Request Headers" ILIKE '%connectionKey%' OR "Request Headers" ILIKE '%CamelWebsocket%' OR "Request Headers" ILIKE '%X-Atmosphere%')
ORDER BY starttime DESC LAST 7 DAYS
high severity medium confidence

QRadar AQL selecting web/proxy events to Camel Atmosphere WebSocket endpoints that carry injected dispatch-targeting headers.

Data Sources

Web ProxyWeb Server DSM

Required Tables

events

False Positives & Tuning

  • Applications using sendToAll broadcast as intended.
  • QA/staging traffic replaying application headers.
  • Proxies normalizing and logging Camel headers benignly.

Other platforms for CVE-2026-71300

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Inject WebSocket dispatch sendToAll header (lab)

    Expected signal: Web/proxy log entry for the request to a *websocket*/*camel* URI containing the sendToAll and connectionKey request headers.

  2. Test 2Inject connectionKey targeting header (lab)

    Expected signal: HTTP POST event to a Camel WebSocket send endpoint carrying connectionKey / CamelWebsocketConnectionKey headers.

  3. Test 3Detect vulnerable camel-atmosphere-websocket JAR on host

    Expected signal: File creation event for camel-atmosphere-websocket-4.18.3.jar (an affected version) under /tmp/lib.

  4. Test 4Windows: drop affected Camel WebSocket JAR (lab)

    Expected signal: DeviceFileEvents record for creation of camel-atmosphere-websocket-4.14.8.jar (affected version).

Last updated: 2026-09-04 Research depth: standard
References (14)

Response Playbook

Triage

  1. Confirm the affected component and version: enumerate deployed org.apache.camel:camel-atmosphere-websocket JARs and check whether the version falls in >= 4.0.0 < 4.14.9, >= 4.15.0 < 4.18.4, or >= 4.19.0 < 4.22.0.
  2. Inspect the flagged inbound requests for headers outside the filtered Camel namespace (e.g. sendToAll, connectionKey, CamelWebsocket*) and determine whether they reached a Camel route that produces to a camel-atmosphere-websocket endpoint.
  3. Correlate the source IP/user against expected clients: broadcast/targeting headers from untrusted or external sources are high-signal for exploitation of the header-injection flaw.
  4. Review Camel route logs for evidence that unfiltered inbound headers were propagated into the WebSocket producer's peer-selection logic.

Containment

  1. Block or rate-limit inbound requests carrying WebSocket dispatch-control headers (sendToAll/connectionKey) at the WAF/reverse proxy in front of the Camel application until patched.
  2. Apply a HeaderFilterStrategy / removeHeaders in the affected Camel routes to strip attacker-controllable headers before the camel-atmosphere-websocket producer, as an interim mitigation.
  3. Restrict the WebSocket endpoint to authenticated, trusted peers and disable sendToAll broadcast where not required by design.

Evidence Collection

  1. Capture the full inbound HTTP request/upgrade headers, source IP, timestamps, and the Camel route/exchange ID for each flagged event.
  2. Preserve the affected application's Camel route definitions, JAR versions (mvn dependency:tree), and any WebSocket dispatch/access logs showing peer targeting.

Escalation Criteria

  • !Escalate to incident response if injected dispatch headers from an untrusted source correlate with WebSocket messages delivered to peers that should not have received them (confirmed message redirection/spoofing).
  • !Escalate if a vulnerable version is confirmed internet-exposed and reachable with attacker-controllable inbound headers, given the CVSS 9.8 rating and public PoC.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web/proxy access logs containing WebSocket upgrade requests with non-namespaced dispatch headers (sendToAll, connectionKey).
  • >Camel application logs and exchange traces showing unfiltered header propagation into the atmosphere-websocket producer.
  • >Deployed JAR inventory (camel-atmosphere-websocket-<version>.jar) confirming an affected version.

Tuning Guidance

Baseline which internal services legitimately send sendToAll/connectionKey headers and allowlist those sources. Tighten the header-name match to those specific to your Camel routes to reduce noise, and prioritize alerts where the source is external/untrusted or the target host is confirmed to run an affected version. Once all camel-atmosphere-websocket instances are upgraded to 4.14.9 / 4.18.4 / 4.22.0 or later, downgrade the artifact-presence signal to informational.

Hunting Queries

Hunt for hosts running affected camel-atmosphere-websocket versions and for inbound traffic carrying injected WebSocket dispatch headers.

Hunting — KQL
kql 
DeviceFileEvents | where FileName matches regex @"camel-atmosphere-websocket-4\.(([0-9]|1[0-3])\.[0-9]+|14\.[0-8]|1[5-7]\.[0-9]+|18\.[0-3]|19\.[0-9]+|2[01]\.[0-9]+)\.jar" | project TimeGenerated, DeviceName, FolderPath, FileName
Hunting — SPL
spl 
index=web (uri_path="*websocket*" OR uri_path="*atmosphere*") | eval hdrs=coalesce(request_headers,http_headers) | search hdrs="*sendToAll*" OR hdrs="*connectionKey*" | stats count by src_ip, uri_path, hdrs

Atomic Red Team Tests

Test 1 Inject WebSocket dispatch sendToAll header (lab)
linux

Sends an HTTP request to a lab Camel Atmosphere WebSocket endpoint with an out-of-namespace dispatch header to simulate header-injection targeting all peers.

Command

bash 
curl -s -o /dev/null -w '%{http_code}\n' -H 'sendToAll: true' -H 'connectionKey: victim-peer-1' 'http://localhost:8080/camel/websocket/broadcast'

Cleanup

bash 
echo 'No persistent artifacts created by this request.'

Expected Telemetry

Web/proxy log entry for the request to a *websocket*/*camel* URI containing the sendToAll and connectionKey request headers.

Expected Detection

The dispatch-header-injection-attempt logic (kql/spl/etc.) matches on the sendToAll/connectionKey headers in the inbound request.

Test 2 Inject connectionKey targeting header (lab)
linux

Simulates an attacker redirecting a WebSocket message to a specific peer by injecting a non-filtered connectionKey header.

Command

bash 
curl -s -X POST -H 'connectionKey: 7f3c-attacker-controlled' -H 'CamelWebsocketConnectionKey: 7f3c' --data 'hello' 'http://localhost:8080/camel/ws/send'

Cleanup

bash 
echo 'No cleanup required; stateless request.'

Expected Telemetry

HTTP POST event to a Camel WebSocket send endpoint carrying connectionKey / CamelWebsocketConnectionKey headers.

Expected Detection

Detection matches on connectionKey / CamelWebsocket header presence in the request headers.

Test 3 Detect vulnerable camel-atmosphere-websocket JAR on host
linux

Places a mock affected-version JAR filename on disk to validate the vulnerable-artifact-present inventory logic.

Command

bash 
mkdir -p /tmp/lib && touch /tmp/lib/camel-atmosphere-websocket-4.18.3.jar

Cleanup

bash 
rm -f /tmp/lib/camel-atmosphere-websocket-4.18.3.jar

Expected Telemetry

File creation event for camel-atmosphere-websocket-4.18.3.jar (an affected version) under /tmp/lib.

Expected Detection

The vulnerable-artifact-present logic flags the affected-version JAR filename.

Test 4 Windows: drop affected Camel WebSocket JAR (lab)
windows

Creates a mock affected-version artifact on Windows to exercise the file-inventory branch of the detection.

Command

powershell 
New-Item -ItemType Directory -Force -Path C:\lab\lib; New-Item -ItemType File -Force -Path C:\lab\lib\camel-atmosphere-websocket-4.14.8.jar

Cleanup

powershell 
Remove-Item -Force C:\lab\lib\camel-atmosphere-websocket-4.14.8.jar

Expected Telemetry

DeviceFileEvents record for creation of camel-atmosphere-websocket-4.14.8.jar (affected version).

Expected Detection

The vulnerable-artifact-present KQL branch matches the affected JAR version.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1499Endpoint Denial of Service

Same Tactic: Initial Access

Popular Detections