Improper Authentication in Apache Camel - CVE-2026-84181
Published: October 23, 2026
Vulnerability identifier: #VU157296
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84181
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access sensitive information under another principal's identity.
The vulnerability exists due to improper authentication in the Apache Camel Shiro security processor when an incoming exchange names the same principal as a subject left bound to a reused thread by an earlier authenticated exchange. A remote attacker can send a request naming a principal in active use without valid credentials to bypass credential verification and access sensitive information as that principal if the request is processed on a thread retaining the matching subject.
Affected software
Apache Camel
How to mitigate CVE-2026-84181
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1