CVE-2026-46456

CVE-2026-46456 — camel-aws2-sqs Inbound Message-Attribute Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Hijacked sink| Demonstrated impact ---|---|---|---|--- Camel Spring Boot| camel-spring-boot/| Sprin...

camel-aws2-sqs: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

CVE-2026-81505

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

EUVD-2026-80902

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719

Quickwit through 0.9.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its SQS file sources . The root cause is a failure to validate the host and scheme of the queue_url parameter, allowing an unauthenticated attacker to supply a malicious value via the create-source API and...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...

scrapy-rss (>=0.1.5, <=0.1.8), scrapy-sqs-exporter (>=1.0.3, <=1.0.4) potentially affected by CVE-2026-84366 via scrapy (1.4.0)

scrapy PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-rss =0.1.5, =1.0.3, =1.0.4 Source cves: CVE-2026-84366 Source advisory: OSV:PYSEC-2026-3918...

scrapy-rss (>=0.1.5, <=0.1.8), scrapy-sqs-exporter (>=1.0.3, <=1.0.4) potentially affected by CVE-2026-84366 via scrapy (1.4.0)

scrapy PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-rss =0.1.5, =1.0.3, =1.0.4 Source cves: CVE-2026-84366 Source advisory: OSV:GHSA-76G3-C3X4-CRVX...

CVE-2026-46456

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, crossplane-provider-aws-elasticache, cloud-provider-aws, external-dns, sops, opentofu, witness, gh, atlantis, gptscript, pulumi-language-yaml, eksctl, buildah, pulumi-language-dotnet, kubernetes, prometheus-operator,...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to improper inbound filtering of SQS message attributes, which allows an attacker who can send messages to the SQS queue to inject arbitrary Camel control headers, potentially influencing downstream producers such a...

Python AWS SQS Reverse Shell

Poll an SQS command queue for tasks and publish results to a response queue. Uses boto3 when available, otherwise falls back to aws CLI. Pairs with listeners/aws/reverseawssqs. from kittysploit import from lib.c2.awssqsreverseagent import buildawssqsreverseagentscript class ModulePayload: """AWS...

CVE-2026-63239: Use of Hard-coded Credentials

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

c2cwsgiutils (>=0.14.0, <=0.16.3), omnibot (1.0.3) +1 more potentially affected by CVE-2025-71176 via pytest (3.1.1)

pytest PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - c2cwsgiutils =0.14.0, =1.0.3, =1.0.4 Source cves: CVE-2025-71176 Source advisory: OSV:PYSEC-2026-1845...

scrapy-rss (>=0.1.5, <=0.1.8), scrapy-sqs-exporter (>=1.0.3, <=1.0.4) potentially affected by CVE-2025-6176 via scrapy (1.4.0)

scrapy PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-rss =0.1.5, =1.0.3, =1.0.4 Source cves: CVE-2025-6176 Source advisory: OSV:PYSEC-2026-1906...

ai.wanaku:wanaku-tool-service-sqs (>=0.0.4, <=0.0.7), org.apache.camel.kafkaconnector:camel-aws-s3-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.0.0-m1, <=4.14.7)

org.apache.camel:camel-aws2-sqs MAVEN version =4.0.0-m1, =0.0.4, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.13.0...

org.apache.camel.kafkaconnector:camel-aws-s3-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-aws-sqs-batch-sink-kafka-connector (4.18.0) +9 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.15.0, <=4.18.2)

org.apache.camel:camel-aws2-sqs MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46456 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892595...

org.apache.camel.quarkus:camel-quarkus-aws2-sqs (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-aws2-sqs-deployment (>=3.35.0, <=3.36.0) +2 more potentially affected by CVE-2026-46456 via org.apache.camel:camel-aws2-sqs (>=4.19.0, <=4.20.0)

org.apache.camel:camel-aws2-sqs MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46456 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892595...