Executive brief
Apache Camel is an open-source integration framework used to connect applications and cloud services, including Amazon SNS for publishing notifications. A configuration gap was found in the SNS integration component that, in a related component, allowed attackers to smuggle in special control values through message data. Analysis confirmed this specific SNS component only sends messages and never receives them, so there is no way for an outside party to actually exploit this gap in practice. The vendor still shipped a fix to align the SNS component's configuration with other components as a precaution, and no customer action is urgently required.
Technical details
The vulnerability class is Improper Input Validation (CWE-20) affecting Sns2HeaderFilterStrategy in the camel-aws2-sns component. The strategy originally only configured an outbound filter pattern (blocking Camel*, breadcrumbId, org.apache.camel.* headers from being written out to AWS SNS) but had no inbound filter rule. In the sibling camel-aws2-sqs component this same gap was exploitable via Sqs2Consumer, which maps inbound SQS message attributes into the Camel Exchange through HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a remote message sender to inject Camel control headers (tracked separately as CVE-2026-46456). However, Sns2Endpoint's createConsumer() throws UnsupportedOperationException and does not support consumers, meaning no external message attributes are ever mapped inbound into a Camel Exchange for SNS, making the missing inbound filter unreachable by an attacker. Fix CAMEL-23506 adds setInFilterStartsWith for the Camel namespace to Sns2HeaderFilterStrategy for consistency with corrected sibling strategies. Fixed versions: 4.14.8, 4.18.3, and 4.21.0; affected ranges are 4.0.0–4.14.8, 4.15.0–4.18.3, and 4.19.0–4.21.0. No workaround is required; operators are advised to continue applying least-privilege IAM permissions on SNS topics as general hygiene.
Affected products
- Apache camel-aws2-sns >=4.0.0 <4.14.8, >=4.15.0 <4.18.3, >=4.19.0 <4.21.0
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database and NVD
- 2026-07-06: patched: Fixed in Apache Camel 4.14.8, 4.18.3, and 4.21.0
- 2026-08-26: advisory: GitHub Advisory reviewed/updated