Improper Authentication in Apache Camel - CVE-2026-80312
Published: October 23, 2026
Vulnerability identifier: #VU157289
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80312
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass OAuth authentication and access protected route endpoints, potentially disclosing sensitive information and performing unauthorized actions.
The vulnerability exists due to fail-open authentication handling in the Apache Camel OAuth processors when an authenticated session cannot be established. A remote attacker can send a request that fails authentication to a route configured to require OAuth to reach the protected endpoint because the processors return control to the route instead of stopping the exchange.
Affected software
Apache Camel
How to mitigate CVE-2026-80312
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1