CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

io.camelbee:camelbee-standalone-core (>=3.2.1, <=4.1.0), io.camelbee:camelbee-standalone-starter (>=3.2.1, <=4.1.0) +20 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http-main (>=4.19.0, <=4.22.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.19.0, =3.2.1, =3.2.1, =1.5.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.20.0, =4.22.0 and more Source cves: CVE-2026-85254 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429367...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.4.1) +18 more potentially affected by CVE-2026-85254 via org.apache.camel:camel-platform-http-main (>=4.0.0, <=4.18.4)

org.apache.camel:camel-platform-http-main MAVEN version =4.0.0, =0.3.0, =1.0, =1.0, =4.7.0, =4.11.0, =4.0.0, =4.0.0, =4.18.0, =4.12.0, =4.7.0, =4.4.0, =4.8.0, =4.17.0, =4.14.0, =4.18.0, =4.18.4 and more Source cves: CVE-2026-85254 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21429367...

org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

CVE-2026-66908

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350293...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: GHSA-FPM2-M4QQ-WGHR...

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: OSV:GHSA-FPM2-M4QQ-WGHR...

EUVD-2026-64959

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-66908

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: MEND:CVE-2026-66908...

Exploit for CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not...

CVE-2026-66908: Improper Authentication

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...