CVE-2026-40022

CVE-2026-40022 is a vulnerability in the Apache Camel embedded HTTP server and embedded management server (camel-platform-http-main) when authentication is enabled via BasicAuthenticationConfigurer or JWTAuthenticationConfigurer and a non-root context path, such as /api or /admin, is configured using camel.server.path or camel.management.path. The issue arises because these configurers derive the authentication path from properties.getPath() if camel.server.authenticationPath or camel.management.authenticationPath is not explicitly set. Due to Vert.x's sub-router mounting model, where the sub-router mounts at the path prefix and the authentication handler registers at the exact resolved path, authentication only applies to the precise context path and not its subpaths. This allows unauthenticated access to protected business routes and management endpoints under those subpaths, such as /api/_route_ or /admin/observe/info. The vulnerability affects Apache Camel versions from 4.14.1 before 4.14.6 and from 4.18.0 before 4.18.2, with a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) and is associated with CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Any unauthenticated attacker with network access to the affected Apache Camel server can exploit this vulnerability by crafting HTTP requests to unprotected subpaths under the configured context paths. For instance, requests to /admin/observe/info bypass authentication entirely, enabling attackers to retrieve sensitive runtime metadata including the current user, working directory, home directory, process ID, JVM details, and operating system information. This results in high confidentiality impact through information disclosure and low integrity impact, potentially aiding further reconnaissance or attacks, without requiring privileges, user interaction, or elevated complexity.

The official Apache Camel security advisory at https://camel.apache.org/security/CVE-2026-40022.html and the announcement on the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/04/26/5 recommend upgrading to Apache Camel version 4.20.0 to remediate the issue. Users on the 4.14.x LTS release stream should upgrade to 4.14.6, while those on the 4.18.x LTS stream should upgrade to 4.18.2. No additional workarounds are specified beyond these version updates.