CVE-2026-46456

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9

Description Improper input validation in the Apache Camel AWS2-SQS component allows an attacker to inject arbitrary Camel control headers into the Camel Exchange. This occurs because the Sqs2HeaderFilterStrategy failed to configure an inbound filter, allowing Sqs2Consumer to copy SQS MessageAttributes—including internal headers like CamelHttpUri, CamelFileName, or CamelSqlQuery—unmodified via the applyFilterToExternalHeaders() function. An entity with permissions to send messages to the consumed SQS queue can use this to influence the behavior of downstream producers, such as redirecting HTTP producers or overriding queries. These injected headers persist across internal direct, seda, and vm hops.

Recommendations Upgrade Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8. Upgrade Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Upgrade Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. As a temporary mitigation, strip Camel control headers from inbound messages at the start of the route using removeHeaders('Camel*') and removeHeaders('camel*') before they reach downstream producers. Restrict access to the consumed SQS queue by applying least-privilege sqs:SendMessage permissions on the queue resource policy.