Loading vulnerability…
CVE-2026-40022 is an authentication bypass vulnerability in Apache Camel's camel-platform-http-main component affecting the embedded HTTP server and embedded management server. The flaw occurs when authentication is enabled and the application is configured to use a non-root context path, such as /api or /admin, through camel.server.path or camel.management.path, while camel.server.authenticationPath or camel.management.authenticationPath is not explicitly set. In this condition, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath(). Due to the Vert.x sub-router mounting model, the sub-router is mounted at the configured context path and the authentication handler is then registered inside that sub-router at the resolved path. As a result, the authentication handler matches only the exact configured context path rather than subpaths beneath it. This allows unauthenticated requests to reach protected business routes and management endpoints located under those subpaths. The issue affects Apache Camel versions 4.14.1 through before 4.14.6 and 4.18.0 through before 4.18.2.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small Java/Maven proof-of-concept reproducer for CVE-2026-40022, an authentication bypass in Apache Camel's camel-platform-http-main component. The project is not an exploit framework module; it is a standalone demo application showing that when Camel's embedded HTTP server is configured with authentication enabled and a non-root context path, but authenticationPath is left unset, the auth handler is attached only to the exact context path rather than all subpaths. As a result, requests to real application subpaths can bypass authentication. Repository structure is minimal and purpose-built: pom.xml pins Camel to vulnerable version 4.18.1 and builds a shaded runnable JAR; Application.java is the main entry point that starts Camel Main and registers the route; HelloRoute.java defines a single GET platform-http route at /hello; application.properties enables the embedded server on port 8080, sets the vulnerable non-root context path /api, enables authentication, and points to auth.properties; auth.properties defines a Basic Auth user camel with password propertiesPass. README.md contains the vulnerability explanation, affected/fixed versions, reproduction steps, and mitigation guidance. Main exploit capability: unauthenticated access to protected HTTP routes under the configured context path. In this PoC, the intended protected route is /api/hello, but it can be fetched without credentials. The README also notes the same issue can affect management endpoints such as /admin/observe/info, potentially disclosing runtime metadata. The exploit is operationally simple: start the vulnerable app and send crafted HTTP GET requests to subpaths under the non-root context path. No shellcode, RCE, or post-exploitation payload is present; this is a focused authentication-bypass PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Apache Camel vulnerability causing information disclosure and authentication bypass in embedded HTTP and management servers.
An authentication bypass vulnerability in Apache Camel's camel-platform-http-main component when authentication is enabled and a non-root context path is configured, allowing unauthenticated access to protected subpaths and exposure of runtime metadata.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.