CVE-2026-46456 Apache CVE debrief

Who should care

Users of Apache Camel versions 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, and 4.19.0 to 4.21.0 should be aware of this vulnerability and take immediate action to mitigate the risk. This includes upgrading to a patched version of Apache Camel or applying compensating controls to prevent exploitation.

Technical summary

The camel-aws2-sqs component in Apache Camel did not configure an inbound filter for SQS MessageAttributes, allowing any principal able to send messages to the consumed SQS queue to set arbitrary Camel control headers that influence the behavior of downstream producers in the route. This could lead to various impacts depending on the producers used in the route, such as redirecting an HTTP producer, changing a file name, or overriding a query. The issue affects Apache Camel versions 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, and 4.19.0 to 4.21.0.

Defensive priority

High priority for users of affected Apache Camel versions due to the critical severity of the vulnerability.

Recommended defensive actions

• Upgrade to Apache Camel version 4.21.0 or later
• If using 4.14.x LTS releases, upgrade to 4.14.8
• If using 4.18.x releases, upgrade to 4.18.3
• For deployments that cannot upgrade immediately, strip Camel control headers from inbound messages before they reach any downstream producer
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by an external researcher and documented by the Apache Camel security team. The issue affects multiple versions of Apache Camel, and users are recommended to upgrade to a patched version. The CVE record was published on 2026-07-06T09:16:36.683Z and has not been modified since then. The NVD entry is currently Analyzed. There is no evidence of exploitation in the wild, but users should still take immediate action to mitigate the risk.

Official resources