CVE-2026-47074 ex_aws_sns SigningCertURL not validated in verify_message/1
Attackers can bypass SNS signature verification by supplying a malicious SigningCertURL, allowing forged messages to be accepted as valid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47074?
CVE-2026-47074 is a high-severity vulnerability in ex-aws ex_aws_sns, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows Signature Spoofing by Improper Validation.
This vulnerability is associated with program files lib/ex_aws/sns.ex, lib/ex_aws/sns/public_key_cache.ex and program routines 'Elixir.ExAws.SNS':verify_message/1, 'Elixir.ExAws.SNS.PublicKeyCache':get/1.
'Elixir.ExAws.SNS':verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that the host matches an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to an endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own key, and cause the function to return :ok, completely bypassing SNS signature verification.
This issue affects ex_aws_sns: from 2.0.1 before 2.3.5.
Weakness: CWE-295
Which versions are affected by CVE-2026-47074?
3 open source packages ship an affected version, including ex_aws_sns.
| Package | Affected | Fixed in |
|---|---|---|
ex_aws_sns Hex | From 2.0.1 | 2.3.5 |
ex_aws_sns Hex | From 2.0.1 | 2.3.5 |
ex_aws_sns Hex | From 2.0.1 | 2.3.5 |
How do I fix CVE-2026-47074?
Upgrade ex_aws_sns to 2.3.5 or later.
Is CVE-2026-47074 being exploited?
There is no known exploitation of CVE-2026-47074 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-47074, GHSA-8jgf-23q5-x7xx.