CVE-2026-40022 Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: MEND:CVE-2026-40022...

CVE-2026-40022: Authentication Bypass Using an Alternate Path or Channel

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...