CVE-2026-46456: Apache Camel AWS2-SQS header injection in Sqs2HeaderFilterStrategy

CVE-2026-46456 · Severity: critical · CVSS 9.8 · Published 2026-07-06

Apache Camel's AWS SQS connector fails to filter untrusted message headers when receiving messages from the queue, allowing any sender with permission to write to the queue to inject Camel internal control headers. An attacker can exploit this to hijack downstream processing—for example, redirecting HTTP requests to different servers, changing file paths, modifying database queries, or altering other producer behavior—potentially leading to data exposure, file manipulation, or service compromise depending on what the application does with received messages.

Technologies: Apache Camel. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-46456 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46456 being exploited in the wild.
How severe is CVE-2026-46456?
Critical severity, with a CVSS score of 9.8, published 6 July 2026.
Which products and versions are affected?
Apache Camel 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0; org.apache.camel:camel-aws2-sqs (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.14.8.
Is there a fix for CVE-2026-46456?
Yes. org.apache.camel:camel-aws2-sqs (Maven): upgrade to 4.14.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46456 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46456?
Check whether you run Apache Camel or org.apache.camel:camel-aws2-sqs (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-aws2-sqs (Maven): upgrade to 4.14.8 or later
    # set org.apache.camel:camel-aws2-sqs to 4.14.8 in your pom.xml or build.gradle

Technical details

This is an improper input validation vulnerability (CWE-20) affecting the camel-aws2-sqs component's HeaderFilterStrategy. The Sqs2HeaderFilterStrategy class configured only an outbound filter via setOutFilterPattern, blocking Camel headers from being written to SQS, but omitted inbound filtering. When Sqs2Consumer processes incoming SQS MessageAttributes via HeaderFilterStrategy.applyFilterToExternalHeaders, the default strategy applies no inbound rules, passing through all headers unchanged—including Camel internal control headers (e.g., CamelHttpUri, CamelFileName, CamelSqlQuery). Any principal with sqs:SendMessage permission (cross-account principals, in-account services with limited privileges) can craft malicious SQS messages with injected control headers. These headers steer downstream producers into unintended behavior (HTTP redirects, file path traversal, SQL query injection) and propagate across internal direct, seda, and vm hops. The fix adds case-insensitive inbound filtering of the Camel* and camel* header namespaces. Patches: 4.14.8, 4.18.3, 4.21.0. Mitigations: strip Camel headers at route start or restrict SQS sender permissions.

Affected products

  • Apache Camel 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0

Identifiers

  • CVE-2026-46456
  • GHSA-cmc3-hr79-8mmv

Timeline

  • 2026-07-06: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-07-06: patched: Patch released in versions 4.14.8, 4.18.3, and 4.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.