Apache Camel CVE-2026-56140

There is no reachable exploitation condition in camel-aws2-sns because the component is producer-only: Sns2Endpoint.createConsumer throws UnsupportedOperationException ('You cannot receive messages from this endpoint'), so no externally-supplied SNS message attributes are ever mapped inbound into a Camel Exchange, and the missing inbound filter rule cannot be triggered by any attacker-supplied input. The header-injection primitive would only be reachable in a component that consumes external messages (the SQS sibling, CVE-2026-46456), which requires an application deployed as an SQS consumer where an attacker can send messages to the monitored queue. For SNS, exploitation is fundamentally limited by the absence of any inbound message-handling code path - this is a defense-in-depth alignment, not an exploitable flaw.

This is a textbook case of a high raw CVSS score that does not reflect real-world risk. The provided NVD vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies remote unauthenticated full compromise, but this directly conflicts with the vendor advisory, which states there is NO known exploit path because camel-aws2-sns is producer-only and never maps external attributes inbound. The corroborating signals all point to negligible risk: EPSS is 0.16% (6th percentile), the CVE is not listed in CISA KEV, and no POC is referenced. The 9.8 appears to be an inherited/templated score from the exploitable SQS sibling (CVE-2026-46456) rather than an assessment of the SNS component's actual reachability. Verdict: NOT a real priority - the header-injection primitive that justifies C:H/I:H/A:H is unreachable in this component. Treat the CVSS score as an overestimate; the true residual risk is defense-in-depth only. This discrepancy between the CVSS network vector and the vendor's 'no exploit path' statement should be noted explicitly for any automated prioritization pipeline.

No realistic attack scenario exists for camel-aws2-sns: the component only produces (publishes) messages to SNS and cannot consume, so an attacker cannot deliver crafted message attributes back into a Camel Exchange to inject control headers. The analogous exploitable scenario lives in the SQS sibling (CVE-2026-46456), where a message sender could inject Camel control headers via inbound message attributes mapped by Sqs2Consumer. No POC is referenced for this SNS CVE.