This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch new-wave-of-cves in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit aa21147d2336aea65fdca90779166106ddee8e84 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:41 2026 +0200 Added CVE-2026-84181 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-84181.md | 21 ++++++++++++++++++++ content/security/CVE-2026-84181.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-84181.md b/content/security/CVE-2026-84181.md new file mode 100644 index 00000000..c8ab9176 --- /dev/null +++ b/content/security/CVE-2026-84181.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-84181" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84181.html +draft: false +type: security-advisory +cve: CVE-2026-84181 +severity: MEDIUM +summary: "Camel-Shiro: authentication bypass - the presented credentials were not verified when the Shiro subject already bound to the thread matched the incoming principal, so a request could reuse an authentication it never performed" +description: "The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never ver [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure th [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24439 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25822 (commit 6f72ae648eb0c6e54a913f7be33cd2c020355b95), backported to camel-4.22.x in https://github.com/apache/camel/pull/25944 (commit 95b4c1500001bc32877df5b8fca0bc7bdd080666) and to camel-4.18.x in https://github.com/apache/camel/pull/25946 (commit 4ec9b37d70b08c478966000fb1bd653abfe410e3). + +The issue is classified as CWE-287 Improper Authentication. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-84181.txt.asc b/content/security/CVE-2026-84181.txt.asc new file mode 100644 index 00000000..4be3d9f5 --- /dev/null +++ b/content/security/CVE-2026-84181.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-84181" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-84181.html +draft: false +type: security-advisory +cve: CVE-2026-84181 +severity: MEDIUM +summary: "Camel-Shiro: authentication bypass - the presented credentials were not verified when the Shiro subject already bound to the thread matched the incoming principal, so a request could reuse an authentication it never performed" +description: "The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never ver [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure th [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24439 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25822 (commit 6f72ae648eb0c6e54a913f7be33cd2c020355b95), backported to camel-4.22.x in https://github.com/apache/camel/pull/25944 (commit 95b4c1500001bc32877df5b8fca0bc7bdd080666) and to camel-4.18.x in https://github.com/apache/camel/pull/25946 (commit 4ec9b37d70b08c478966000fb1bd653abfe410e3). + +The issue is classified as CWE-287 Improper Authentication. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrUACgkQ406fOAL/ +QQBGWwf/R7cLmJr7BQ0IzMmesxzMPZJ+bwNtlX9HZkpm8zPDV6B/LB43D8XoUPAA +kxsIF7uHcl66TVzJ1NyTgDNH9I9dQ61KvC0bLnxmn2efc91ET+bz1wLWqP2kj3/o +M4+ckBc6Aka9BNEAZWj5r5LcqpPOUusSphYyhwuwUprquyAQjrFnqSdMz1VyhdAw +fvNfNP4bR6oHVbOEHmlO1Lk+48ryGu/m94viInVgv0EPHO+ByuHvoLm3sDL1YjAo +NqFrKFsi20JltiUgRVNNdssCe4YnZJ3e3xP4u0h8KkR1ua9KLwiHPecWsG/aviOn +MVlUHoYRorhxXa/W3W3NdrqifIOONw== +=Ey/4 +-----END PGP SIGNATURE-----
