CVE-2026-48204: Apache Camel camel-mongodb-gridfs Header Injection Enables GridFS Operation Override

What's the Vulnerability

CVE-2026-48204 is a critical (CVSS 9.8) input validation flaw (CWE-20) in the Apache Camel camel-mongodb-gridfs component. The root cause is a failure to filter caller-supplied gridfs.* HTTP/Camel exchange headers before they are applied to GridFS producer operations. Because these headers are trusted without sanitization, an attacker who can influence request headers reaching a Camel route can override the intended GridFS operation — for example forcing a delete, listAll, or findOne in place of an intended write — and inject NoSQL query operators into the GridFS filter query passed to the backing MongoDB metadata collection.

Impact ranges from unauthorized disclosure of stored file metadata and contents, to deletion of stored files, to broader NoSQL injection against the MongoDB collection backing GridFS.

Affected Software

The vulnerability affects the Maven artifact org.apache.camel:camel-mongodb-gridfs across three release lines:

• >= 4.0.0, < 4.14.8
• >= 4.15.0, < 4.18.3
• >= 4.19.0, < 4.21.0

No patched version date has been published at this time. Organizations using this component in Camel-based integration pipelines that expose GridFS operations via inbound headers should treat this as an active exposure until upgraded.

Exploitation Status

A public proof-of-concept and advisory exist (GHSA-f7g3-2cg6-f5hj), but the flaw is not currently listed as a known exploited vulnerability (KEV) and no evidence of in-the-wild weaponization is noted. Defenders should still prioritize this given the low exploitation barrier (header manipulation over HTTP) and the severity of the outcome — unauthenticated or lightly-authenticated data loss and disclosure.

How Our Detection Catches It

We ship coverage across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the detection logic focuses on identifying requests or exchange traffic where caller-controlled gridfs.* headers are present and inconsistent with the operation the endpoint is expected to perform — for example, a write-oriented endpoint receiving a header value that maps to a delete or list operation, or GridFS filter parameters containing NoSQL operator syntax (e.g. $where, $ne, $gt) that should never originate from legitimate client input. This lets us flag both operation-override attempts and NoSQL injection attempts against the GridFS metadata collection without relying on a single exploit signature.

Get the Full Detection

For the complete KQL, SPL, and other SIEM queries, along with MITRE ATT&CK mapping and remediation guidance, see the full detection page: CVE-2026-48204 – Apache Camel camel-mongodb-gridfs Header Injection.