CVE-2026-66908: Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.

CVE-2026-66908 · Severity: high · CVSS 7.5 · Published 2026-08-24

Apache Camel's embedded HTTP server component accepts JWT tokens for API authentication. When administrators configured JWT with a keystore but omitted optional issuer and audience settings, the server silently failed to validate those claims—accepting any unexpired token signed by the trusted keystore, regardless of who issued it or which service it was intended for. This authentication bypass could allow attackers with access to legitimately-issued tokens from other services or identity providers to access protected APIs.

Technologies: Apache Camel. Vendors: Apache, Maven.

Quick answers

Is CVE-2026-66908 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66908 being exploited in the wild.
How severe is CVE-2026-66908?
High severity, with a CVSS score of 7.5, published 24 August 2026.
Which products and versions are affected?
Apache Camel 4.8.0 through 4.21.x (unpatched); 4.22.0+ (patched); 4.14.9 and 4.18.4 with partial mitigation; org.apache.camel:camel-platform-http-main (Maven) >= 4.8.0, < 4.22.0, ECOSYSTEM:introduced=4.8.0,fixed=4.22.0.
Is there a fix for CVE-2026-66908?
Yes. org.apache.camel:camel-platform-http-main (Maven): upgrade to 4.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66908 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-66908?
Check whether you run Apache Camel or org.apache.camel:camel-platform-http-main (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.camel:camel-platform-http-main (Maven): upgrade to 4.22.0 or later
    # set org.apache.camel:camel-platform-http-main to 4.22.0 in your pom.xml or build.gradle

Technical details

This is an improper authentication vulnerability (CWE-287) in the JWT claim validation logic of Apache Camel's embedded HTTP server. The JWTAuthenticationConfigurer.buildJwtOptions method returns null when neither jwtIssuer nor jwtAudience properties are configured, causing the caller to skip the JWTAuthOptions.setJWTOptions call. The resulting Vert.x JWTAuth instance built only from the keystore validates signature and expiry but not issuer (iss) or audience (aud) claims. An attacker with network access to the HTTP endpoints and possession of any unexpired JWT signed by a key in the configured keystore—regardless of its actual issuer or intended audience—can impersonate an authorized client. The vulnerability is silent: no warnings are logged and the server starts normally, making misconfiguration difficult to detect. Both the application and management servers are affected due to the same omission in both authentication paths. Versions 4.8.0–4.21.x have no supported configuration option to enforce these claims; 4.14.9 and 4.18.4 backport configuration options but do not change the unsafe default; 4.22.0 introduces a fail-closed behavior requiring explicit opt-in to disable claim validation.

Affected products

  • Apache Camel Platform HTTP Main 4.8.0 through 4.21.x (unpatched); 4.22.0+ (patched); 4.14.9 and 4.18.4 with partial mitigation

Identifiers

  • CVE-2026-66908
  • GHSA-fpm2-m4qq-wghr

Timeline

  • 2026-08-24: disclosed: Vulnerability disclosed in CVE-2026-66908 and GHSA-fpm2-m4qq-wghr
  • 2026: patched: Fixed in version 4.22.0 with fail-closed behavior and new jwtAllowMissingIssuerAndAudience option
  • 2026: patched: Partial mitigation via jwtIssuer and jwtAudience configuration options in versions 4.14.9 and 4.18.4, but unsafe default remains

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.