12 matches found
CVE-2026-40022
camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...
org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component
A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...
CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...
CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...
Exploit for CVE-2026-66908
CVE-2026-66908 — camel-platform-http-main JWT iss/aud not...
CVE-2026-49097: Improper Input Validation
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header the constant...
CVE-2026-40022 Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...
CVE-2026-40022 Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...
CVE-2026-40022 Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...
CVE-2026-40022: Authentication Bypass Using an Alternate Path or Channel
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...
