Apache Camel Platform Http Main
Monthly
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.