Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-40022

CVE-2026-40022: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityHigh8.2

    High [CVE-2026-40022] Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

    CVE-2026-40022Source published Source updated

    When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such…

    Affected products in this advisory
    • Apache Camel
    • HTTP Server
    Source-reported affected versions
    • Apache Camel Platform HTTP Main 4.14.1 before 4.14.6
    • Apache Camel Platform HTTP Main 4.18.0 before 4.18.2
    Source-reported fixed versions
    • 4.14.6
    • 4.18.2
    Mitigation guidance
    • Users are recommended to upgrade to version 4.20.0, which fixes the issue.
    • If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6.
    • If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.2

    High [CVE-2026-40022] Information disclosure and authentication bypass in embedded HTTP/management servers

    CVE-2026-40022Source published

    Information disclosure and authentication bypass in embedded HTTP/management servers. Red Hat rates this important (CVSS 8.2). Weakness: CWE-551. Affected package(s): camel-http-starter, camel-http-common, camel-http-base, camel-http. Resolved in Red Hat advisory RHSA-2026:17668 — update the affected packages (`sudo dnf update`).

    Affected products in this advisory
    • Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14
    Source-reported affected versions
    • camel-http-starter
    • camel-http-common
    • camel-http-base
    • camel-http
    Source-reported fixed versions
    • RHSA-2026:17668
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:17668 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features