Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.camel:camel-salesforce

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

    CVE-2026-49099 · GHSA-gcc7-c8mp-34qx

    Affected
    • Maven org.apache.camel:camel-salesforce >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0
    Fixed in
    4.21.04.14.84.18.3· Vendor fix available
    Issue
    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search, the target SObject name and id, the Apex REST URL and method, and the Apex query parameters - from Exchange message headers, reading the header in preference to the value configured on the endpoint (AbstractSalesforceProcessor.getParameter() reads the header first and uses the endpoint configuration only as a fallback). The control-header constants in SalesforceEndpointConfig (for example SOBJECTQUERY = sObjectQuery, SOBJECTSEARCH = sObjectSearch, SOBJECTNAME = sObjectName, SOBJECTID = sObjectId, APEXURL = apexUrl, APEXMETHOD = apexMethod, and the apexQueryParam. prefix) used plain, non-Camel-prefixed values. Because these names do not start with the Camel / camel prefix,…

    Recommended action: Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →