CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being written out) and did not configure an inbound filter rule. For the related camel-aws2-sqs component this inbound gap was exploitable, because the Sqs2Consumer maps inbound SQS message attributes into the Camel Exchange via HeaderFilterStrategy.applyFilterToExternalHeaders, allowing a message sender to inject Camel control headers (tracked as CVE-2026-46456). camel-aws2-sns, by contrast, is producer-only: Sns2Endpoint does not support consumers (createConsumer throws UnsupportedOperationException, 'You cannot receive messages from this endpoint'), so no externally-supplied message attributes are ever mapped inbound into a Camel Exchange through SNS, and the missing inbound filter rule on Sns2HeaderFilterStrategy was therefore not reachable by an attacker. As part of the same fix (CAMEL-23506), an inbound filter rule (setInFilterStartsWith for the Camel namespace) was added to Sns2HeaderFilterStrategy so that its configuration matches the corrected Sqs2HeaderFilterStrategy and the other sibling strategies. This is a defense-in-depth alignment with no known exploit path in camel-aws2-sns. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. This is a defense-in-depth hardening change with no known exploit path in camel-aws2-sns, which is producer-only, so no urgent action or workaround is required. Users who want the aligned behaviour can upgrade to version 4.21.0, or to 4.14.8 on the 4.14.x LTS releases stream, or to 4.18.3 on the 4.18.x releases stream, which contain the change. As a general best practice, operators should continue to apply least-privilege IAM permissions on their SNS topics.

• CWE-20

• https://camel.apache.org/security/CVE-2026-56140.htmlVendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56131libexpat before 2.8.2 lacks handler call depth tracking for …4.9
• CVE-2026-56132In libexpat before 2.8.2, there is a heap-based buffer overf…6.9
• CVE-2026-56137RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. con…8.4
• CVE-2026-56138AIL framework contains a path traversal vulnerability in the…5.3
• CVE-2026-56139Generation of Error Message Containing Sensitive Information…5.3
• CVE-2026-5614A security flaw has been discovered in Belkin F9K1015 1.00.1…8.8
• CVE-2026-56141In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.…9.8
• CVE-2026-56142In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.…8.8
• CVE-2026-56144Incorrect Authorization (CWE-863) in Elasticsearch can allow…6.5
• CVE-2026-56145Uncontrolled Resource Consumption (CWE-400) in Elasticsearch…6.5
• CVE-2026-56146Improper Access Control (CWE-284) in Kibana can lead to unau…5.4
• CVE-2026-56147Authorization Bypass Through User-Controlled Key (CWE-639) i…7.1