PT-2026-35385 · Apache · Apache Camel

Jihang Yu · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-40022

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.14.1 through 4.14.5 Apache Camel versions 4.18.0 through 4.18.1

Description When authentication is enabled on the embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path (e.g., "/api" or "/admin") is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() if camel.server.authenticationPath or camel.management.authenticationPath is not explicitly set. Due to the Vert.x sub-router mounting model, the authentication handler only matches the exact configured context path rather than its subpaths. Consequently, unauthenticated requests to subpaths, such as "/api/ route " or "/admin/observe/info", can access protected business routes and management endpoints without credentials. The "/observe/info" endpoint may disclose runtime metadata, including the user, working directory, home directory, process ID, JVM, and operating system information.

Recommendations Upgrade to version 4.14.6 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.2 for those on the 4.18.x LTS releases stream. Upgrade to version 4.20.0.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-40022

GHSA-27VM-5VPJ-RP5G

Affected Products

Apache Camel

References · 12

• https://camel.apache.org/security/CVE-2026-40022.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40022 · Security Note
• https://osv.dev/vulnerability/GHSA-27vm-5vpj-rp5g · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/a9ebee94af976ac2afd7906d2e76673067d8be86 · Note
• https://github.com/apache/camel/pull/22474 · Note
• https://github.com/apache/camel/pull/22476 · Note
• https://github.com/apache/camel/commit/6ec12cbebfc1b6360cdaac1c1f8c681864911695 · Note
• https://github.com/apache/camel/commit/7b5b8c0283c0ab8d703d868ded7614018762a553 · Note
• https://github.com/apache/camel/pull/22475 · Note
• http://openwall.com/lists/oss-security/2026/04/26/5 · Note
• https://twitter.com/CVEnew/status/2048852219961729425 · Twitter Post