CVE-2026-46456

[CVE catalog]

Severity

Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jul 5, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.79% · Oct 25, 2026

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected headers can then influence the behavior of downstream producers in the route, potentially leading to unauthorized message manipulation or redirection of data. camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers This is a Critical improper input validation vulnerability in the `camel-aws2-sqs` component of Red Hat build of Apache Camel. A remote attacker with `sqs:SendMessage` permissions to a consumed SQS queue can inject arbitrary Camel control headers into the message exchange. This allows for manipulation of downstream producer behavior, potentially leading to data redirection, file modification, or query alteration, without requiring authentication to the Camel application itself. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.