This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit a23ee8cfc837ab024b3b50e012e4b05d569f2fe5 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Aug 24 11:13:54 2026 +0200 Added CVE-2026-66908 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-66908.md | 21 ++++++++++++++++++++ content/security/CVE-2026-66908.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-66908.md b/content/security/CVE-2026-66908.md new file mode 100644 index 00000000..09cd8d0d --- /dev/null +++ b/content/security/CVE-2026-66908.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-66908" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-66908.html +draft: false +type: security-advisory +cve: CVE-2026-66908 +severity: HIGH +summary: "Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted" +description: "The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT keystore properties. JWTAuthenticationConfigurer.buildJwtOptions returned null when neither jwtIssuer nor jwtAudience was configured, and the caller then skipped the JWTAuthOptions.setJWTOptions call entirely, so the Vert.x JWTAuth instance was built from the keystore alone. The result was that inbound tokens were checked only [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. From 4.22.0 the server refuses to start when a JWT keystore is configured but neither jwtIssuer nor jwtAudience is set, naming the properties involved, and a deployment that genuinely wants signature and expiry validation only must say so explicitly with the new jwtAllowMissingIssuerAndAudience option, which defaults to false. This behaviour is fixed only on 4.22.0. The 4.14.9 and 4.18.4 releases do n [...] +credit: "Reported by n0mi1k" +affected: "From 4.8.0 before 4.22.0." +fixed: 4.22.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24281 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25187 (commit 4dbb9387102c102ab207e61c8307a3eaaeec7fcf) and is first available in the 4.22.0 release. It calls assertIssuerOrAudienceConfigured at the top of both configureAuthentication overloads, so the application server and the management server are both covered, throwing IllegalArgumentException when a JWT keystore is configured but neither issuer nor audience is set; and it adds jwtAllowMissingIssuerAndAudience to b [...] + +The fail-closed guard could not be backported. The jwtIssuer and jwtAudience options were themselves only introduced in 4.21.0 by CAMEL-23525, so on camel-4.18.x and camel-4.14.x there was nothing an operator could set to satisfy the requirement and the guard would have broken every JWT deployment on those branches with no remedy available. Those lines instead received the options alone, through https://github.com/apache/camel/pull/25195 (commit 23c6bbf0e026277f03732481f780b9f18044792b, [...] diff --git a/content/security/CVE-2026-66908.txt.asc b/content/security/CVE-2026-66908.txt.asc new file mode 100644 index 00000000..8a8e5ec1 --- /dev/null +++ b/content/security/CVE-2026-66908.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-66908" +date: 2026-08-24T10:00:00+02:00 +url: /security/CVE-2026-66908.html +draft: false +type: security-advisory +cve: CVE-2026-66908 +severity: HIGH +summary: "Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted" +description: "The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT keystore properties. JWTAuthenticationConfigurer.buildJwtOptions returned null when neither jwtIssuer nor jwtAudience was configured, and the caller then skipped the JWTAuthOptions.setJWTOptions call entirely, so the Vert.x JWTAuth instance was built from the keystore alone. The result was that inbound tokens were checked only [...] +mitigation: "Users are recommended to upgrade to version 4.22.0, which fixes the issue. From 4.22.0 the server refuses to start when a JWT keystore is configured but neither jwtIssuer nor jwtAudience is set, naming the properties involved, and a deployment that genuinely wants signature and expiry validation only must say so explicitly with the new jwtAllowMissingIssuerAndAudience option, which defaults to false. This behaviour is fixed only on 4.22.0. The 4.14.9 and 4.18.4 releases do n [...] +credit: "Reported by n0mi1k" +affected: "From 4.8.0 before 4.22.0." +fixed: 4.22.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24281 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25187 (commit 4dbb9387102c102ab207e61c8307a3eaaeec7fcf) and is first available in the 4.22.0 release. It calls assertIssuerOrAudienceConfigured at the top of both configureAuthentication overloads, so the application server and the management server are both covered, throwing IllegalArgumentException when a JWT keystore is configured but neither issuer nor audience is set; and it adds jwtAllowMissingIssuerAndAudience to b [...] + +The fail-closed guard could not be backported. The jwtIssuer and jwtAudience options were themselves only introduced in 4.21.0 by CAMEL-23525, so on camel-4.18.x and camel-4.14.x there was nothing an operator could set to satisfy the requirement and the guard would have broken every JWT deployment on those branches with no remedy available. Those lines instead received the options alone, through https://github.com/apache/camel/pull/25195 (commit 23c6bbf0e026277f03732481f780b9f18044792b, [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqMChkACgkQ406fOAL/ +QQDE/gf9H4VYJyU/CdWCgoLp8az2fQvoXs2dZ+sveP6smEzkJqR3EjpDNORDjxXb +gb6Zq9dsdqpEACYpGJqRo8kqNDXRW1qpk17YiQUlqJp8OcjlZxGonWXAj5P4m7b7 +dXTSXCaxWu9/rm5pUug4cXbn+NpGBvorx+Air2givAgiKGRMpTLcSLbJVaZQLRZ7 +NiZvR/nV5t0TucBF5ipUBF+cYZZXcot8keRFnlLhvx2QO6MNcFiOtbFuJ/Jg+HGa +cDVqudQl5ZlNHrvW2eurI/YtfyGdgSM/g3g7IvKqN/7eJ3tJ7hkNicjbfajdhXIp +m4PnRML3xTG44IGCsR+/ezW1S4NMVA== +=CKfp +-----END PGP SIGNATURE-----
