CVE-2026-40022
published 2026-04-27CVE-2026-40022: When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path…
PriorityP356high8.2CVSS 3.1
AVNACLPRNUINSUCHILAN
EPSS
0.62%
45.9th percentile
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information.
This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2.
Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | >= 4.14.1 < 4.14.6 | 4.14.6 |
| apache | camel | >= 4.15.0 < 4.18.2 | 4.18.2 |
| apache_software_foundation | apache_camel_platform_http_main | >= 4.14.1 < 4.14.6 | 4.14.6 |
| apache_software_foundation | apache_camel_platform_http_main | >= 4.18.0 < 4.18.2 | 4.18.2 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers
vendor_redhat·2026-04-27·CVSS 8.2
CVE-2026-40022 [HIGH] CWE-551 camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers
camel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers
A flaw was found in the Apache Camel embedded HTTP server and embedded management server (camel-platform-http-main). When authentication is enabled and a non-root context path is configured, the authentication handler incorrectly matches only the exact configured path, not its subpaths. This allows a remote, unauthenticated attacker to bypass authentication and access protected business routes and management endpoints. Specifically, the `/observe/info` endpoint can disclose sensitive runtime metadata, including user, working directory, process ID, and operating system information.
Package: openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 (OpenShift Se
GHSA
Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
ghsa·2026-04-27
CVE-2026-40022 [HIGH] CWE-288 Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact c
No detection rules found.
No public exploits indexed.
https://camel.apache.org/security/CVE-2026-40022.htmlhttp://www.openwall.com/lists/oss-security/2026/04/26/5https://access.redhat.com/errata/RHSA-2026:17668https://access.redhat.com/security/cve/CVE-2026-40022https://bugzilla.redhat.com/show_bug.cgi?id=2463178https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40022.json
2026-04-27
Published