Apache Camel camel-mail inbound header injection leading to route manipulation and possible RCE

CVE-2026-33454 is an important-severity vulnerability in Apache Camel's camel-mail component caused by incomplete header filtering in MailHeaderFilterStrategy. The strategy configures outbound filtering via setOutFilterStartsWith but does not configure inbound filtering via setInFilterStartsWith. As a result, when a Camel application consumes email through camel-mail, such as via from("imap://...") or from("pop3://..."), Camel-prefixed MIME headers from inbound messages are mapped into the Camel Exchange without being filtered. An attacker who can send email to a mailbox monitored by the vulnerable mail consumer can inject Camel-specific headers into the message flow. Those injected headers can influence downstream Camel components, including camel-bean, camel-exec, and camel-sql, altering route behavior and in some application designs enabling remote code execution or unsafe command/data handling.