Spring Cloud AWS Vulnerability in Amazon SNS Integration
CVE-2026-44308

6.3MEDIUM

Key Information:

Vendor

Awspring

Status
Spring-cloud-aws
Spring-cloud-aws-sns
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44308?

The Spring Cloud AWS integration with Amazon SNS, versions 3.0.0 through 4.0.1, lacks proper verification of the signature for incoming SNS messages. This vulnerability allows unauthenticated attackers who know the endpoint URL to send forged HTTP POST requests that mimic legitimate SNS notifications or subscription confirmations. This flaw undermines the security mechanisms of applications relying on AWS services and could lead to unauthorized operations. The issue is rectified in version 4.0.2, which includes the necessary checks to ensure that incoming messages are authenticated.

Affected Version(s)

spring-cloud-aws >= 3.0.0, < 4.0.2

spring-cloud-aws-sns >= 3.0.0, < 4.0.2

References

https://github.com/awspring/spring-cloud-aws/security/adv...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.