HighPublic exploitVulnerability

CVE-2026-80312

Fail-open authentication bypass in Apache Camel OAuth

Published Oct 19, 2026 · Updated 3 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

9 mentions · peak 4 in a dayToday

CVSS8.2High · v3.1

EPSS0.57%47th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: Apache Software Foundation

IdentifiersCVE-2026-80312CWE-287 · Improper Authentication

CVE-2026-80312 is an improper authentication vulnerability in Apache Camel's camel-oauth component, affecting versions 4.11.0 before 4.18.5 and 4.19.0 before 4.22.1. OAuth processors guarding a route fail to stop the exchange when an authenticated session cannot be established. Instead, they return control to the route, allowing unauthenticated requests to continue to protected endpoints as though authentication had succeeded. This fail-open behavior occurs on the ordinary request path of an OAuth-protected route.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Remote unauthenticated attackers can access restricted endpoints and invoke downstream route operations without satisfying OAuth authentication. The resulting exposure depends on the protected route's functionality and may include disclosure of sensitive information and unauthorized modifications. The recorded CVSS 3.1 assessment indicates high confidentiality impact, low integrity impact, and no availability impact.

Mitigation

If you can’t patch tonight, do this now.

If an immediate upgrade is not possible, place an explicit authorization check after the OAuth processor and before protected route operations. Verify that authentication or authorization failure stops the exchange rather than allowing execution to continue.

Remediation

Patch, then assume compromise.

Upgrade to Apache Camel 4.23.0. Deployments on the 4.18.x LTS stream should upgrade to 4.18.5, and deployments on the 4.22.x LTS stream should upgrade to 4.22.1. The corrected processors stop the exchange and set an appropriate error status whenever an authenticated session cannot be established. Deployments on the end-of-life 4.14.x line should migrate to a supported, patched release.

Public exploits

Exploits

1 exploit validated by Mallory's analysis.

View more in app →

CVE-2026-80312The repository contains two self-contained Java/Maven authentication-bypass reproductions, not an exploit-framework module. Its 17 files comprise five Java sources, three READMEs, two Maven POMs, two Dockerfiles, two Docker Compose definitions, two application configuration files, and a .gitignore. The Spring Boot module contains an application entry point, an attacker/report controller, and an Undertow-backed protected route. The Quarkus module contains an equivalent JAX-RS report resource and platform-http protected route; Quarkus supplies application startup. Both drivers send a hardcoded loopback GET /protected without an Authorization header. Each protected route invokes OAuthBearerTokenProcessor before setting HTTP 200 and a synthetic PROTECTED-DATA response. The claimed vulnerability is that authentication failure sets an error status but does not stop the Camel exchange, allowing subsequent protected steps to execute and overwrite the status. The drivers inspect the returned marker to demonstrate actual protected-step execution rather than relying solely on HTTP status. They also support comparison against patched dependencies through Maven version overrides, but contain no automated test suite, configurable remote target, executable payload, credential theft, or exfiltration destination. The documentation attributes this behavior to CVE-2026-80312/CWE-287 and lists fixes in Camel 4.18.5, 4.22.1, and 4.23.0, with Camel Quarkus 3.40.0 as a patched control. These advisory and version claims are repository assertions; the supplied material does not include the vulnerable dependency source or execution evidence, so exploitability and dependency availability were not independently verified. A 401 response alone is not definitive evidence of patch status outside this controlled reproduction. Both Compose deployments publish port 8080; Spring Boot's separate port 8081 remains unpublished by Compose. No original repository URL, git reference, or archive size was supplied; empty metadata and size 0 indicate unavailable information.oscerd · Disclosed Oct 18, 2026 · java · webPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Apache Software FoundationCamelapplication

External references

References

MITRE CVEcve.org · CVE-2026-80312 NVDnvd.nist.gov/vuln/detail/CVE-2026-80312 MITRE CWE · CWE-287Improper Authentication camel.apache.orgcamel.apache.org/security/CVE-2026-80312.html github.comgithub.com/apache/camel/pull/25567 github.comgithub.com/apache/camel/pull/25575 github.comgithub.com/apache/camel/pull/25576 issues.apache.orgissues.apache.org/jira/browse/CAMEL-24411

Activity feed

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

ghsa syntheticNews · Oct 19, 2026GHSA-5m9r-c7qx-c2h6A fail-open authentication vulnerability in the Apache Camel OAuth component allows unauthenticated callers to reach protected route endpoints when an authenticated session cannot be established. It affects versions 4.11.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1. Exploitation requires no prior access or special configuration beyond a route configured to require OAuth. Fixed versions include 4.18.5, 4.22.1, and 4.23.0. As a temporary mitigation, add an explicit authorization check after the OAuth processor and verify that routing stops on authentication failure.Read more ↗cvefeed high severityNews · Oct 19, 2026CVE-2026-80312 - Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open ProcessorsA remotely exploitable authentication bypass in Apache Camel's OAuth component, rated High with CVSS 3.1 score 8.2. Failed authentication does not terminate routing, allowing unauthenticated requests to reach protected endpoints without prior access or special configuration. Affected versions are 4.11.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1. Fixes are available in 4.18.5, 4.22.1, and 4.23.0. Deployments unable to upgrade should add an explicit authorization check after the OAuth processor and verify that authentication failures stop the route.Read more ↗camel apacheNews · Oct 15, 2026Apache Camel Security Advisory - CVE-2026-80312 - Apache CamelAn authentication bypass in Apache Camel's camel-oauth processors allows requests to continue to protected endpoints when authentication cannot be completed. The processors return control to the route instead of terminating the exchange. Exploitation requires neither prior access nor special configuration beyond a route configured to require OAuth. Fixed releases are 4.23.0, 4.18.5, and 4.22.1. The end-of-life 4.14.x line does not receive the fix and should be upgraded to 4.18.5 or later. As an interim mitigation, add an explicit authorization check after the OAuth processor and verify that routing stops on failure.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity5Community discussion across Reddit, Mastodon, and other social sources.