CVE-2026-56140
published 2026-07-06CVE-2026-56140: Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
34.9th percentile
Improper Input Validation vulnerability in Apache Camel AWS SNS component.
The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns.
This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators s
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | >= 4.0.0 < 4.14.8 | 4.14.8 |
| apache | camel | >= 4.15.0 < 4.18.3 | 4.18.3 |
| apache | camel | >= 4.19.0 < 4.21.0 | 4.21.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability exists in the Sns2HeaderFilterStrategy class within the camel-aws2-sns component, which lacked an inbound filter rule (setInFilterStartsWith for the Camel namespace). Detection should focus on use of this component in affected Apache Camel versions (4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0). ↗
- →The component is producer-only and createConsumer throws UnsupportedOperationException. No inbound message attribute mapping occurs, so there is no known exploit path. Detection/triage should confirm no consumer path exists in deployed configurations. ↗
- →The sibling vulnerability CVE-2026-46456 in camel-aws2-sqs (Sqs2Consumer) represents the exploitable variant of this class of header injection flaw. Detections built for CVE-2026-46456 (Camel control header injection via SQS message attributes) are the relevant operational reference. ↗
- →The fix is tracked under CAMEL-23506. Verify patched versions (4.14.8, 4.18.3, 4.21.0) are deployed by checking the camel-aws2-sns JAR version in the application classpath. ↗
- ·This CVE has NO known exploit path. The camel-aws2-sns component is producer-only and never maps inbound external message attributes into a Camel Exchange, making the missing inbound filter rule unreachable by an attacker. No urgent action or workaround is required. ↗
- ·Affected version ranges are Apache Camel 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0. Red Hat packages (OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat JBoss EAP Expansion Pack) are all marked Not Affected. ↗
- ·As a general best practice referenced in the advisory, least-privilege IAM permissions should be applied on SNS topics regardless of this CVE's exploitability status. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Input Validation vulnerability in Apache Camel AWS SNS component.
ghsa_unreviewed·2026-07-06·CVSS 9.8
CVE-2026-56140 [CRITICAL] CWE-20 Improper Input Validation vulnerability in Apache Camel AWS SNS component.
Improper Input Validation vulnerability in Apache Camel AWS SNS component.
The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-onl
VulDB
Apache Camel up to 4.14.8/4.18.2/4.20.x Camel-AWS2-SNS injection
vuldb·2026-07-05
CVE-2026-56140 [CRITICAL] Apache Camel up to 4.14.8/4.18.2/4.20.x Camel-AWS2-SNS injection
A vulnerability was found in Apache Camel up to 4.14.8/4.18.2/4.20.x. It has been rated as critical. Impacted is an unknown function of the component Camel-AWS2-SNS. Performing a manipulation results in injection.
This vulnerability is known as CVE-2026-56140. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is advised.
Red Hat
org.apache.camel/camel-aws2-sns: Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation
vendor_redhat·2026-07-06·CVSS 9.8
CVE-2026-56140 [CRITICAL] org.apache.camel/camel-aws2-sns: Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation
org.apache.camel/camel-aws2-sns: Apache Camel AWS SNS Component: Defense-in-depth hardening due to improper input validation
A flaw was found in the Apache Camel AWS SNS component (`camel-aws2-sns`). An improper input validation vulnerability exists in the `Sns2HeaderFilterStrategy` due to a missing inbound filter rule. However, this component is producer-only, meaning it does not process external messages in a way that would allow an attacker to exploit this flaw. This issue is considered a defense-in-depth hardening change with no known exploit path.
Package: openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 (OpenShift Serverless) - Not affected
Package: camel-aws2-sns (Red Hat build of Apache Camel 4 for Quarkus 3) - Not affected
Package: camel-aws2-sns (Red Hat bui
No detection rules found.
No public exploits indexed.
2026-07-06
Published