Input validation error in Apache Camel - CVE-2026-46456
Published: August 24, 2026
Vulnerability identifier: #VU144705
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46456
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject Camel control headers and influence the behavior of downstream producers.
The vulnerability exists due to improper input validation in the camel-aws2-sqs component header filtering logic when mapping inbound SQS message attributes into the Camel Exchange. A remote user can send a specially crafted SQS message with arbitrary message attributes to inject Camel control headers and influence the behavior of downstream producers.
The injected headers can persist across internal direct, seda, and vm hops, and the specific downstream effect depends on which producers the route uses.
Affected software
Apache Camel
How to mitigate CVE-2026-46456
Install security update from vendor's website.
Apache Camel - addressed in versions 4.15.0, 4.19.0, 4.21.0