What is the CVSS score of CVE-2026-46456?

CVE-2026-46456 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-46456?

A critical vulnerability in Apache Camel's AWS SQS integration allows authenticated message senders to inject headers that redirect network traffic, rename files, or alter database queries in…. A patch is available.

How to fix or mitigate CVE-2026-46456?

Within 24 hours: Audit systems running camel-aws2-sqs (Apache Camel AWS2-SQS component) and identify all routes consuming SQS messages. Within 7 days: Apply vendor-released patch to camel-aws2-sqs across all affected systems per the Apache Camel security advisory. Within 30 days: Execute regression testing on SQS-consuming routes, restrict sqs:SendMessage IAM permissions to trusted internal principals only, and implement inbound message-header validation rules where feasible.

Apache Camel CVE-2026-46456

EUVD-2026-41830 CRITICAL

Improper Input Validation (CWE-20)

2026-07-05

GHSA-cmc3-hr79-8mmv

Microsoft Apache Information Disclosure Camel Red Hat

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Attacker needs sqs:SendMessage on the queue (PR:L) and a header-sensitive downstream producer must exist (AC:H); impact is chiefly integrity via header injection, with variable confidentiality and no direct availability loss.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:14 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Jul 06, 2026 - 10:01 EUVD

Analysis Generated

Jul 05, 2026 - 20:16 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

20 maven packages depend on org.apache.camel:camel-aws2-sqs (9 direct, 11 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 5

News 15 New Kubernetes Vulnerabilities - 8 Critical, 7 High Severity Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Apache Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 06, 2026 News 15 New Java Vulnerabilities - 8 Critical, 7 High Severity Patched Jul 05, 2026 News Critical Header Injection in Kubernetes via Apache Camel AWS2-SNS - CVE-2026-46456 Jul 05, 2026

AnalysisAI

Camel-internal control header injection in the Apache Camel AWS2-SQS component (camel-aws2-sqs) lets any principal holding sqs:SendMessage on a consumed SQS queue override downstream producer behaviour in a route. Because Sqs2HeaderFilterStrategy defined only an outbound filter and no inbound filter, DefaultHeaderFilterStrategy copied sender-supplied attributes such as CamelHttpUri, CamelFileName and CamelSqlQuery verbatim into the Exchange, so an attacker can redirect HTTP producers, rename files or override SQL queries. This is a design flaw with no public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.

Technical ContextAI

Apache Camel is a widely used Java enterprise-integration framework whose components map external protocol metadata onto a normalized Camel Exchange. The camel-aws2-sqs consumer (Sqs2Consumer) uses the AWS SDK v2 to poll Amazon SQS and calls HeaderFilterStrategy.applyFilterToExternalHeaders to copy each SQS MessageAttribute into the Exchange as a Camel message header. Sqs2HeaderFilterStrategy extended the default strategy but set only setOutFilterPattern (blocking Camel*, breadcrumbId and org.apache.camel.* from being written back to the broker), leaving the inbound filter unset; DefaultHeaderFilterStrategy therefore treated every inbound attribute name as unfiltered. This maps to CWE-20 (Improper Input Validation): the root cause is trusting externally controlled header names, including reserved Camel control headers that steer producer behaviour (CamelHttpUri, CamelFileName, CamelSqlQuery, etc.). These injected headers also survive internal direct:, seda: and vm: hops, so their influence propagates through the whole route.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.21.0, which adds an inbound HeaderFilterStrategy rule to Sqs2HeaderFilterStrategy that filters the Camel header namespace case-insensitively so sender-supplied Camel*/camel* headers are no longer mapped into the Exchange. LTS and stream users should upgrade to 4.14.8 (4.14.x LTS) or 4.18.3 (4.18.x). For deployments that cannot upgrade immediately, strip Camel control headers at the very start of the route before any downstream producer, e.g. removeHeaders('Camel*') and removeHeaders('camel*') to catch the case-insensitive variants - with the side effect that any legitimately propagated Camel headers set upstream of that point are also removed, so place it immediately after the SQS consumer. Additionally, apply least-privilege sqs:SendMessage permissions on the queue resource policy to restrict which principals and cross-account senders can post to the consumed queue. Reference the vendor advisory at https://camel.apache.org/security/CVE-2026-46456.html.