Medium [CVE-2026-84181] Improper Authentication vulnerability in Apache Camel Shiro component
This medium-severity Apache Software Foundation advisory covers CVE-2026-84181 affecting Apache Camel Shiro.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Improper Authentication vulnerability in Apache Camel Shiro component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange.
Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never verified.
The condition depends on thread reuse and on the principal matching, which is why it is not reached on every request, but it requires nothing of the attacker beyond sending a request naming a principal that is in active use.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it.
- 4.0.0 before 4.18.5
- 4.19.0 before 4.22.1
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
- 4.18.5
- 4.22.1
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
Mitigation checklist
- Upgrade to Apache Camel 4.23.0, which fixes the issue.
- Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
- Users on the 4.22.x LTS releases stream should upgrade to 4.22.1.
- For deployments that cannot upgrade immediately, ensure the Shiro subject is cleared from the thread at the end of every exchange so that no subject can be inherited by a later one.
Official advisory · high-confidence parse· fetched 9 days ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
- CVE-2026-115721Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all
- CVE-2026-90885Oct 26, 2026Apache Camel Saxon XXE
- CVE-2026-94386Oct 26, 2026Apache Camel Oauth information disclosure
- CVE-2026-110748Oct 26, 2026This issue affects Apache SIS from version 0.7 through 1.6 inclusive
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.