Severity:
CVSS 3.1: 5.9 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-shiro) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-shiro) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-shiro) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-shiro) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-shiro) 4.23.0 unaffected
Description:
Improper Authentication vulnerability in Apache Camel Shiro component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
The Shiro security processor skipped credential verification when the subject
already bound to the current thread carried the same principal as the incoming
exchange. Because the thread that carries a Camel exchange is drawn from a pool
and reused across exchanges, a subject left bound by an earlier authenticated
exchange could satisfy the check for a later one that presented no valid
credentials of its own. The password on the incoming exchange was, in that
case, never verified. The condition depends on thread reuse and on the
principal matching, which is why it is not reached on every request, but it
requires nothing of the attacker beyond sending a request naming a principal
that is in active use.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The processor now verifies the presented
credentials on every exchange rather than accepting a subject already bound to
the thread. Setting alwaysReauthenticate=false restores the previous behaviour
for deployments that depend on it. For deployments that cannot upgrade
immediately, ensure the Shiro subject is cleared from the thread at the end of
every exchange so that no subject can be inherited by a later one.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The processor now verifies the presented
credentials on every exchange rather than accepting a subject already bound to
the thread. Setting alwaysReauthenticate=false restores the previous behaviour
for deployments that depend on it.
Work Arounds:
For deployments that cannot upgrade immediately, ensure the Shiro subject is
cleared from the thread at the end of every exchange so that no subject can be
inherited by a later one.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-84181.html
https://issues.apache.org/jira/browse/CAMEL-24439
https://github.com/apache/camel/pull/25822
https://github.com/apache/camel/pull/25944
https://github.com/apache/camel/pull/25946
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-84181
