CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350293...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: GHSA-FPM2-M4QQ-WGHR...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: MEND:CVE-2026-66908...

Exploit for CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.15.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.15.0, =4.15.0, =4.17.0, =4.15.0, =4.18.0, =4.15.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

CVE-2026-40022

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: MEND:CVE-2026-40022...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

CVE-2026-40022: Authentication Bypass Using an Alternate Path or Channel

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...