CVE-2026-46456
Description
A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected headers can then influence the behavior of downstream producers in the route, potentially leading to unauthorized message manipulation or redirection of data.
Statement
This is a Critical improper input validation vulnerability in the camel-aws2-sqs component of Red Hat build of Apache Camel. A remote attacker with sqs:SendMessage permissions to a consumed SQS queue can inject arbitrary Camel control headers into the message exchange. This allows for manipulation of downstream producer behavior, potentially leading to data redirection, file modification, or query alteration, without requiring authentication to the Camel application itself.
Mitigation
To mitigate this issue, configure your Camel routes to strip Camel control headers from inbound messages before they reach any downstream producer. Additionally, restrict who can send messages to the consumed SQS queue by applying least-privilege `sqs:SendMessage` permissions on the queue resource policy. For example, add `removeHeaders('Camel*')` and `removeHeaders('camel*')` at the start of the route. Ensure that any changes to route configurations are properly deployed and services are reloaded or restarted if necessary for the changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
