CVE-2026-84181
Received Received - Intake

Improper Authentication in Apache Camel Shiro Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never verified. The condition depends on thread reuse and on the principal matching, which is why it is not reached on every request, but it requires nothing of the attacker beyond sending a request naming a principal that is in active use. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure the Shiro subject is cleared from the thread at the end of every exchange so that no subject can be inherited by a later one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-84181
EUVD
EUVD-2026-104184

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84181 is an improper authentication vulnerability in Apache Camel's Shiro component. It occurs because the Shiro security processor skips credential verification when a Shiro subject already bound to the current thread matches the principal in the incoming exchange. This happens due to thread reuse in the Camel exchange pool, allowing an attacker to bypass authentication by sending a request with a principal that is already in use without needing valid credentials.

Detection Guidance

To detect this vulnerability, check the Apache Camel version in use with commands like 'camel --version' or inspect the application's dependency tree (e.g., 'mvn dependency:tree' for Maven projects). Verify if the camel-shiro component is present and if the version falls within the affected range (4.0.0 to 4.18.4 or 4.19.0 to 4.22.0).

Monitor logs for unusual authentication bypass attempts, particularly where the same principal is reused across exchanges. Look for patterns where credentials are not verified despite mismatched passwords.

Impact Analysis

This vulnerability allows unauthorized access to systems using Apache Camel's Shiro component. Attackers can exploit it by sending requests with a known active principal, bypassing authentication checks. The impact includes potential data breaches, unauthorized actions, and compromised system integrity. The vulnerability does not affect every request but can be exploited by any attacker who knows an active principal.

Compliance Impact

This vulnerability can lead to unauthorized access, which may violate compliance requirements such as GDPR (data protection) and HIPAA (health information security). It undermines authentication controls required by these regulations, potentially resulting in data breaches, non-compliance penalties, and loss of trust. Organizations must address this flaw to maintain regulatory compliance.

Mitigation Strategies

Immediately upgrade Apache Camel to version 4.23.0, or to 4.18.5 for the 4.18.x LTS stream, or to 4.22.1 for the 4.22.x LTS stream. If upgrading is not possible, set 'alwaysReauthenticate=false' to restore previous behavior or clear the Shiro subject from the thread after each exchange to prevent inheritance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84181. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart