Improper Authentication in Apache Camel - CVE-2026-40022
Published: August 25, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and disclose sensitive information.
The vulnerability exists due to improper access control in the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer authentication path handling for camel-platform-http-main when handling requests to subpaths under a configured non-root context path. A remote attacker can send crafted unauthenticated requests to protected subpaths to bypass authentication and disclose sensitive information.
The issue occurs when authentication is enabled and a non-root context path is configured for the embedded HTTP server or embedded management server, while the authentication path is not explicitly set. The /observe/info endpoint can expose runtime metadata including user, working directory, home directory, process ID, JVM, and operating system information.