CVE-2026-40022: Apache Camel embedded HTTP/management servers can bypass authentication on subpaths when a non-root context path is configured, allowing unauthenticated access to protected routes and management endpoints.
CVE-2026-40022 is verified against org.apache.camel:camel-platform-http-main · maven affected versions: 4.14.1 before 4.14.6, 4.18.0 before 4.18.2 fixed version: 4.14.6 / 4.18.2 / 4.20.0 This medium reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00267.
pruva-verify REPRO-2026-00267 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00267/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh When authentication is enabled for Apache Camel's embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path (e.g., /api or /admin) is configured via camel.server.path or camel.management.path, the authentication handler is registered only for the exact context path. Due to the Vert.x sub-router mounting model (_path_*), subpaths are not protected unless camel.server.authenticationPath / camel.management.authenticationPath is explicitly set. As a result, unauthenticated requests to subpaths (e.g., /api/_route_ or /admin/observe/info) can reach protected business routes and management endpoints.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.