CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential exposure reflected origin + credentials Runnable proof-of-concept reproducer for the Apache Camel vulnerability where VertxPlatformHttpServerSupport. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check —...

CVE-2026-85316 Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whether its configured path started with t...

Exploit for CVE-2026-84176

CVE-2026-84176 — camel-platform-http-vertx: CORS credential ex...

org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350293...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: GHSA-FPM2-M4QQ-WGHR...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: MEND:CVE-2026-66908...

CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

Exploit for CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.15.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.15.0, =4.15.0, =4.17.0, =4.15.0, =4.18.0, =4.15.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...