What is the CVSS score of CVE-2026-40022?

CVE-2026-40022 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Camel Platform Http Main are affected by CVE-2026-40022?

Apache Camel versions 4.14.1-4.14.5 and 4.18.0-4.18.1 contain an authentication bypass vulnerability allowing external attackers to access protected administrative interfaces without credentials,…. A patch is available.

How to fix or mitigate CVE-2026-40022?

Within 24 hours, identify all systems running Apache Camel versions 4.14.1-4.14.5 or 4.18.0-4.18.1 with non-root context path configurations and assess whether management endpoints are exposed to untrusted networks. Within 7 days, apply the vendor-released patch to all affected instances and validate that authentication handlers properly enforce access controls on all management routes and subpaths. Within 30 days, complete deployment across all environments, implement monitoring for unauthorized access attempts to /observe/info and management endpoints, and audit logs for evidence of unauthorized access during the exposure period.

Apache Camel Platform Http Main CVE-2026-40022

EUVD-2026-25807 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-27 apache

GHSA-27vm-5vpj-rp5g

Apache Information Disclosure Apache Camel Platform Http Main Apache Software Foundation

8.2

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:04 vuln.today

Patch released

Apr 28, 2026 - 19:41 nvd

Patch available

CVSS changed

Apr 27, 2026 - 16:22 NVD

8.2 (None) 8.2 (HIGH)

Patch available

Apr 27, 2026 - 11:01 EUVD

EUVD ID Assigned

Apr 27, 2026 - 10:00 euvd

EUVD-2026-25807

CVE Published

Apr 27, 2026 - 09:40 nvd

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 maven packages depend on org.apache.camel:camel-platform-http-main (4 direct, 10 indirect)

Ecosystem-wide dependent count for version 4.14.1.

DescriptionCVE.org

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information.

This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2.

Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.

AnalysisAI

Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.