Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at path* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/route or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information.
This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2.
Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.camel:camel-platform-http-main | >= 4.14.1, < 4.14.6, >= 4.18.0, < 4.18.2, >= 4.19.0, < 4.20.0 | 4.14.6, 4.18.2, 4.20.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-40022
- https://github.com/apache/camel/pull/22474
- https://github.com/apache/camel/pull/22475
- https://github.com/apache/camel/pull/22476
- https://github.com/apache/camel/commit/6ec12cbebfc1b6360cdaac1c1f8c681864911695
- https://github.com/apache/camel/commit/7b5b8c0283c0ab8d703d868ded7614018762a553
- https://github.com/apache/camel/commit/a9ebee94af976ac2afd7906d2e76673067d8be86
- https://camel.apache.org/security/CVE-2026-40022.html
- https://github.com/apache/camel
- http://www.openwall.com/lists/oss-security/2026/04/26/5
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N- Weakness (CWE)
CWE-288- Platform
- Java / Kotlin (Maven)
- Package
org.apache.camel:camel-platform-http-main- Disclosed
- 27.04.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-27vm-5vpj-rp5g - CC BY 4.0
Vulnerability history: org.apache.camel:camel-platform-http-main
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2026: 2
-
Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.