LiveActive security incident?Get immediate response
CVE Record

CVE-2026-40022: Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw can let unauthenticated users reach Apache Camel HTTP business routes or management endpoints that were expected to require Basic or JWT authentication. Exposure depends on using the affected camel-platform-http-main runtime with non-root server or management paths. The main business risk is unauthorized data access, including runtime metadata disclosure.

Executive priority

Treat this as a high-priority patching item for affected Camel services, especially where HTTP or management endpoints are reachable beyond trusted networks. The issue can bypass intended authentication without user interaction.

Technical view

Authentication handlers are registered against an incorrectly derived path when camel.server.path or camel.management.path is non-root and authenticationPath is unset. Because Vert.x mounts a sub-router at the context path, the handler matches only that exact path, allowing subpaths to bypass authentication. Affected versions are 4.14.1 before 4.14.6 and 4.18.0 before 4.18.2.

Likely exposure

Likely exposed systems run org.apache.camel:camel-platform-http-main on affected Apache Camel versions, enable embedded HTTP or management authentication, configure non-root paths such as /api or /admin, and do not explicitly set the authenticationPath properties.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. The CVSS vector indicates network access, low attack complexity, no privileges, and no user interaction, so internet-facing or broadly reachable Camel endpoints should be prioritized.

Researcher notes

The issue is configuration-dependent, not a universal Apache Camel exposure. Focus review on path mounting and authentication handler coverage for subpaths. Do not assume exploitation or affected downstream products beyond the cited Apache and Red Hat sources.

Mitigation direction

  • Upgrade Apache Camel to 4.20.0 where feasible.
  • Use 4.14.6 if staying on the 4.14.x LTS stream.
  • Use 4.18.2 if staying on the 4.18.x LTS stream.
  • Review Apache and Red Hat guidance for product-specific remediation.
  • Restrict network access to Camel HTTP and management endpoints until patched.

Validation and detection

  • Inventory deployments using org.apache.camel:camel-platform-http-main.
  • Identify versions 4.14.1 through before 4.14.6 and 4.18.0 through before 4.18.2.
  • Check for camel.server.path or camel.management.path set to non-root values.
  • Check whether camel.server.authenticationPath or camel.management.authenticationPath is explicitly configured.
  • Confirm embedded HTTP or management authentication is enabled.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-288: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-551: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-40022 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
3ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2CISA-ADP
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N3.94.2redhat-SADP

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2026-40022Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
redhat-SADPcamel-http: Apache Camel: Information disclosure and authentication bypass in embedded HTTP/management servers
other:Red Hat severity ratingcvssV3_1
  • 2026-04-27T10:01:32.316Z: Reported to Red Hat.
  • 2026-04-27T09:40:28.107Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Apache Software FoundationApache Camel Platform HTTP Mainorg.apache.camel:camel-platform-http-main, 4.14.1, 4.18.0unaffected
Weakness

CWE details

CWE-288CWE-551

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.