CVE-2026-40022

Modified Modified - Updated After Analysis

Authentication Bypass in Apache Camel HTTP Server Exposes Sensitive Data

Publication date: 2026-04-27

Last updated on: 2026-06-30

Assigner: Apache Software Foundation

Description

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-27

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-40022

EUVD

EUVD-2026-25807

Affected Vendors & Products

Vendor	Product	Version / Range
apache	camel	From 4.15.0 (inc) to 4.18.2 (exc)
apache	camel	From 4.14.1 (inc) to 4.14.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-551	If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2026-40022 is an authentication bypass vulnerability in Apache Camel's embedded HTTP server and management server components, specifically in the camel-platform-http-main module.

When authentication is enabled and a non-root context path such as /api or /admin is configured without explicitly setting the authentication path, the authentication handler only matches the exact configured context path but not its subpaths.

This means unauthenticated requests to subpaths like /api/_route_ or /admin/observe/info can bypass authentication and access protected business routes and management endpoints.

The /observe/info endpoint can disclose sensitive runtime metadata including user information, working directory, home directory, process ID, JVM details, and operating system information.

Impact Analysis

This vulnerability can allow unauthenticated users to bypass authentication controls and access protected business routes and management endpoints.

Sensitive runtime metadata such as user details, working directory, home directory, process ID, JVM, and operating system information can be exposed through endpoints like /admin/observe/info.

Such unauthorized access can lead to information disclosure and potentially facilitate further attacks or exploitation of the system.

Mitigation Strategies

To mitigate this vulnerability, users are advised to upgrade Apache Camel to a fixed version.

Upgrade to version 4.20.0 if possible.
If using the 4.14.x LTS stream, upgrade to 4.14.6.
If using the 4.18.x LTS stream, upgrade to 4.18.2.

Compliance Impact

This vulnerability allows unauthenticated access to protected business routes and management endpoints, including the /observe/info endpoint which can disclose sensitive runtime metadata such as user information, working directory, home directory, process ID, JVM, and operating system details.

Such unauthorized disclosure of sensitive information could potentially lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data and mandate proper authentication and access controls.

Therefore, the vulnerability poses a risk to compliance by enabling unauthorized access and exposure of sensitive system and user-related information.

Detection Guidance

This vulnerability can be detected by testing whether unauthenticated requests to subpaths of configured non-root context paths bypass authentication. Specifically, sending HTTP requests to subpaths such as /api/_route_ or /admin/observe/info and checking if these requests are accepted without credentials indicates the presence of the vulnerability.

For detection, you can use command-line tools like curl to send requests to these subpaths and observe if authentication is enforced.

curl -i http://<server_address>/api/_route_
curl -i http://<server_address>/admin/observe/info

If these requests return sensitive information or do not prompt for authentication, the system is vulnerable.

Hi! I’m here to help you understand CVE-2026-40022. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70