CVE-2026-40022

camel-platform-http-main Authentication Bypass on Non-Root Context Paths CVE-2026-40022 This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main component the embedded HTTP / management server of the Camel main runtime, tracked as CVE-2026-40022. When...

org.apache.camel/camel-platform-http-main: org.apache.camel/camel-main: Apache Camel: Improper authentication allows JWT bypass in Platform HTTP Main component

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350293...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: OSV:GHSA-FPM2-M4QQ-WGHR...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: GHSA-FPM2-M4QQ-WGHR...

io.camelbee:camelbee-standalone-core (3.2.1), io.camelbee:camelbee-standalone-starter (3.2.1) +22 more potentially affected by CVE-2026-66908 via org.apache.camel:camel-platform-http-main (>=4.8.0, <=4.21.0)

org.apache.camel:camel-platform-http-main MAVEN version =4.8.0, =0.3.0, =1.0, =1.0, =4.8.1, =4.11.0, =4.8.0, =4.8.0, =4.18.0, =4.12.0, =4.8.0, =4.8.0, =4.8.0, =4.17.0, =4.21.0 and more Source cves: CVE-2026-66908 Source advisory: MEND:CVE-2026-66908...

Exploit for CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: OSV:GHSA-27VM-5VPJ-RP5G...

org.apache.camel.karaf:camel-platform-http-main (4.14.5), org.apache.camel.springboot:camel-observability-services-starter (>=4.14.1, <=4.14.5) +11 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.14.1, <=4.14.5)

org.apache.camel:camel-platform-http-main MAVEN version =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.1, =4.14.5 Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (>=1.0, <=1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.15.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.15.0, =0.3.0, =1.0, =1.0, =4.15.0, =4.15.0, =4.15.0, =4.18.0, =4.15.0, =4.15.0, =4.15.0, =4.17.0, =4.15.0, =4.18.0, =4.15.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321645...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

org.apache.camel.springboot:camel-observability-services-starter (4.19.0), org.apache.camel:camel-jbang-core (4.19.0) +14 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (4.19.0)

org.apache.camel:camel-platform-http-main MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-platform-http-main and may be impacted: - org.apache.camel.springboot:camel-observability-services-starter 4.19.0 -...

io.github.luigidemasi:camel-jbang-plugin-kit (>=0.3.0, <=0.3.1), io.kaoto.forage:camel-jbang-plugin-forage (1.1) +17 more potentially affected by CVE-2026-40022 via org.apache.camel:camel-platform-http-main (>=4.18.0, <=4.18.1)

org.apache.camel:camel-platform-http-main MAVEN version =4.18.0, =0.3.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.0, =4.18.1 and more Source cves: CVE-2026-40022 Source advisory: MEND:CVE-2026-40022...

CVE-2026-40022

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server camel-platform-http-main and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and...