---
title: "CVE-2026-56140: Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy"
url: https://erroneo.us/security/cve/CVE-2026-56140/
description: "CVE-2026-56140 (org.apache.camel:camel-aws2-sns (Maven)): Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-06
date_modified: 2026-08-26
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-56140"
kev: false
cvss: 9.8
epss: 0.00738
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-56140: Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.7% , percentile 54: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 54% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes org.apache.camel:camel-aws2-sns (Maven) >= 4.0.0, < 4.14.8, fixed in 4.14.8 ; org.apache.camel:camel-aws2-sns (Maven) >= 4.15.0, < 4.18.3, fixed in 4.18.3 ; org.apache.camel:camel-aws2-sns (Maven) >= 4.19.0, < 4.21.0, fixed in 4.21.0 . Check your lockfile, including transitive dependencies.

## What it is

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel, breadcrumbId and org.apache.camel. headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.

## Affected packages

- Maven `org.apache.camel:camel-aws2-sns` >= 4.0.0, < 4.14.8 → fixed: 4.14.8
- Maven `org.apache.camel:camel-aws2-sns` >= 4.15.0, < 4.18.3 → fixed: 4.18.3
- Maven `org.apache.camel:camel-aws2-sns` >= 4.19.0, < 4.21.0 → fixed: 4.21.0

## Affected products (CVE record)

- Apache Software Foundation Apache Camel AWS2 SNS: 4.0.0 < 4.14.8, 4.15.0 < 4.18.3, 4.19.0 < 4.21.0

## Severity

- CISA-ADP CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.74% probability of exploitation activity in the next 30 days; percentile 54.

## Sources

- [camel.apache.org](https://camel.apache.org/security/CVE-2026-56140.html)
- [GitHub Advisory GHSA-w2v8-8q6c-3rhr](https://github.com/advisories/GHSA-w2v8-8q6c-3rhr)
- [CVE.org record CVE-2026-56140](https://www.cve.org/CVERecord?id=CVE-2026-56140)
- [NVD entry CVE-2026-56140](https://nvd.nist.gov/vuln/detail/CVE-2026-56140)
- [github.com](https://github.com/apache/camel/pull/23221)
- [github.com](https://github.com/apache/camel/pull/23357)
- [github.com](https://github.com/apache/camel/pull/23373)
- [github.com](https://github.com/apache/camel/commit/5f57258fb33d33ef99df10594f8fe9f11d7c2b7e)
- [github.com](https://github.com/apache/camel/commit/7b334be0419839097a132d4ff3427fc4083e695e)
- [github.com](https://github.com/apache/camel/commit/b7f78292e747a28dbf5da444265557b5f9f3c1a1)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.14.8)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.18.3)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.21.0)
- [issues.apache.org](https://issues.apache.org/jira/browse/CAMEL-23506)

---
Source page: https://erroneo.us/security/cve/CVE-2026-56140/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt