# CVE-2026-40022: Apache Camel authentication bypass in camel-platform-http-main

Source: https://junglewise.ai/threats/cve-2026-40022-apache-camel-authentication-bypass-in-camel-platform-http-main  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40022 · Severity: high · CVSS 8.2 · Published 2026-04-27

Apache Camel, a popular integration framework, contains a security flaw in its embedded web and management servers. When specific security settings are enabled, the system fails to properly protect sub-pages (subpaths) of the main application or management interface. This allows unauthorized individuals to bypass login requirements and access sensitive business data or internal system information, such as process IDs and operating system details.

Technologies: [Red Hat build of Apache Camel for Spring Boot](https://junglewise.ai/threats/technologies/red-hat-build-of-apache-camel-for-spring-boot). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-40022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40022 being exploited in the wild.

**How severe is CVE-2026-40022?** High severity, with a CVSS score of 8.2, published 27 April 2026.

**Which products and versions are affected?** Apache Software Foundation Camel Platform HTTP Main 4.14.1 to 4.14.5, 4.18.0 to 4.18.1; org.apache.camel:camel-platform-http-main (Maven) ECOSYSTEM:introduced=4.14.1,fixed=4.14.6; Red Hat build of Apache Camel for Spring Boot 4.18.1.

**Is there a fix for CVE-2026-40022?** Yes. org.apache.camel:camel-platform-http-main (Maven): upgrade to 4.14.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40022 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40022?** Check whether you run Apache Software Foundation Camel Platform HTTP Main, org.apache.camel:camel-platform-http-main (Maven) or Red Hat build of Apache Camel for Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.camel:camel-platform-http-main (Maven): upgrade to 4.14.6 or later

  ```sh
  # set org.apache.camel:camel-platform-http-main to 4.14.6 in your pom.xml or build.gradle
  ```


## Technical details

An authentication bypass exists in Apache Camel's camel-platform-http-main component due to incorrect path matching in the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes. When a non-root context path (e.g., /api) is configured without an explicit authentication path, the authentication handler only applies to the exact path rather than its subpaths. This occurs because the Vert.x sub-router mounting model registers the handler at the resolved path inside a sub-router mounted at the base path. Consequently, unauthenticated requests to subpaths like /api/route or /admin/observe/info bypass security checks. This can result in the disclosure of JVM, OS, and process metadata via the /observe/info endpoint. The issue is fixed in versions 4.14.6, 4.18.2, and 4.20.0.

## Affected products

- Apache Software Foundation Camel Platform HTTP Main 4.14.1 to 4.14.5, 4.18.0 to 4.18.1
- Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 4.18.1

## Identifiers

- CVE-2026-40022
- GHSA-27vm-5vpj-rp5g

## Timeline

- 2026-04-26: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-27: advisory: NVD and Apache advisory published
- 2026-05-14: patched: Red Hat released security advisory RHSA-2026:17668

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://camel.apache.org/security/CVE-2026-40022.html](https://camel.apache.org/security/CVE-2026-40022.html)
- [http://www.openwall.com/lists/oss-security/2026/04/26/5](http://www.openwall.com/lists/oss-security/2026/04/26/5)
- [https://access.redhat.com/errata/RHSA-2026:17668](https://access.redhat.com/errata/RHSA-2026:17668)
- [https://access.redhat.com/security/cve/CVE-2026-40022](https://access.redhat.com/security/cve/CVE-2026-40022)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2463178](https://bugzilla.redhat.com/show_bug.cgi?id=2463178)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40022.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40022.json)

## Related threats

- [Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.](https://junglewise.ai/threats/cve-2026-66908-apache-camel-platform-http-main-jwt-authentication-bypass)
- [Spring Boot weak PRNG in random value property source](https://junglewise.ai/threats/cve-2026-40975-spring-boot-weak-prng-in-random-value-property-source)
- [Apache Camel unsafe deserialization in camel-infinispan](https://junglewise.ai/threats/cve-2026-40858-apache-camel-unsafe-deserialization-in-camel-infinispan)
- [Apache Camel header injection in Camel-Mail component](https://junglewise.ai/threats/cve-2026-33454-apache-camel-header-injection-in-camel-mail-component)
- [Apache Camel RCE via case-variant header injection in non-HTTP components](https://junglewise.ai/threats/cve-2026-40453-apache-camel-rce-via-case-variant-header-injection-in-non-http)