CVE-2026-40022

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.

• CWE-288
• CWE-551

• https://camel.apache.org/security/CVE-2026-40022.htmlVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/26/5Mailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:17668
• https://access.redhat.com/security/cve/CVE-2026-40022
• https://bugzilla.redhat.com/show_bug.cgi?id=2463178
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40022.json

Published

Apr 27, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40011An attacker sending a large number of crafted DNS queries mi…3.7
• CVE-2026-40012ECS zero scoped answers are stored in the packet cache while…5.3
• CVE-2026-40016Attacker can upload a malicious Sieve script over ManageSiev…6.5
• CVE-2026-4002The Petje.af plugin for WordPress is vulnerable to Cross-Sit…4.3
• CVE-2026-40020Attacker can use the IMAP SETACL command to inject the anyon…4.3
• CVE-2026-40021Apache Log4net's XmlLayout https://logging.apache.org/log4n…5.3
• CVE-2026-40023Apache Log4cxx's XMLLayout https://logging.apache.org/log4c…5.3
• CVE-2026-40024The Sleuth Kit through 4.14.0 contains a path traversal vuln…7.1
• CVE-2026-40025The Sleuth Kit through 4.14.0 contains an out-of-bounds read…6.1
• CVE-2026-40026The Sleuth Kit through 4.14.0 contains an out-of-bounds read…7.1
• CVE-2026-40027ALEAPP (Android Logs Events And Protobuf Parser) through 3.4…8.4
• CVE-2026-40028Hayabusa versions prior to 3.8.0 contain a cross-site script…5.4