Apache Camel’s AWS2‑SQS component incorrectly validates inbound message attributes, allowing an attacker to embed Camel control headers such as CamelHttpUri, CamelFileName, or CamelSqlQuery into SQS messages. These headers are mapped into the Exchange unchanged because the inbound HeaderFilterStrategy is not configured, giving the sender the ability to alter the behavior of downstream producers. The injected headers can redirect HTTP calls, change file destinations, or modify database queries, thereby compromising confidentiality, integrity, or availability depending on the route configuration.

The issue affects Apache Camel versions from 4.0.0 up to, but not including, 4.14.8, from 4.15.0 up to 4.18.3, and from 4.19.0 up to, but not including, 4.21.0. Deployments running any of these releases should verify their version and determine whether an upgrade is feasible.

The CVSS score of 9.8 classifies this vulnerability as Critical, indicating that the potential impact on confidentiality, integrity, and availability is severe. Exploitation requires an attacker with the ability to send messages to the SQS queue, which typically demands IAM permissions for sqs:SendMessage. The EPSS score remains below 1 %, suggesting that widespread exploitation is currently low, but the high CVSS score means that once an attacker gains queue‑write privileges, they can inject arbitrary Camel control headers that will influence all downstream route components, potentially redirecting HTTP calls, altering file destinations, or manipulating database queries. The vulnerability is not listed in the CISA KEV catalog. Because the injected headers persist across internal routing hops, the overall risk in exposed routes remains Critical, demanding immediate attention.