CVE-2026-40022 - Vulnerability Analysis

Overview

Apache Camel 4.14.1 < 4.14.6 and 4.18.0 < 4.18.2 contains an authentication bypass caused by improper authentication path matching in embedded HTTP and management servers, letting unauthenticated attackers access protected subpaths and disclose runtime metadata, exploit requires authentication enabled with non-root context paths.

Severity & Score

Impact

Unauthenticated attackers can access protected endpoints and disclose sensitive runtime metadata, risking information disclosure and potential further attacks.

Mitigation

Upgrade to 4.20.0, or 4.14.6 for 4.14.x LTS, or 4.18.2 for 4.18.x LTS.

References

• https://camel.apache.org/security/CVE-2026-40022.html
• http://www.openwall.com/lists/oss-security/2026/04/26/5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner