Camel Netty HTTP auth bypass exposes routes (CVE-2026-80343) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-80343 is a high-severity authentication bypass in Apache Camel 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1 that lets an unauthenticated remote caller reach protected Netty HTTP routes by changing the case of a single letter in the request path. Fixed in Camel 4.23.0, with backports in 4.18.5 and 4.22.1.

Overview

Apache Camel’s camel-netty-http component applies security constraints to configured context paths. In affected versions, the constraint checked the incoming request path against that configured context path using a case-sensitive comparison. The routing layer that already dispatches requests to endpoints did not apply the same rule. The two comparisons disagreed whenever a path’s case differed from the configured value.

Because the constraint and the router disagree, an attacker can flip the case of a character in a path segment. The security constraint no longer treats the path as protected and skips its check. The request still dispatches to the same endpoint. The protected route is reached without satisfying the constraint.

Impact

An external caller with only network access to the Camel consumer can bypass authorization on routes that were meant to be protected. No credential, prior access, or special configuration is needed. Any logic behind the constraint, including authentication and role checks or IP allow-listing, is silently skipped for the disguised path. The CVSS score is 8.2 (HIGH), with low attack complexity and no privileges or user interaction required. Confidentiality and integrity of exposed endpoints are the primary risk.

Note that no evidence of active exploitation has been published. The availability of proof-of-concept detail means exposure should be treated as a live risk rather than a theoretical one.

Remediation and Mitigation

• Upgrade to Apache Camel 4.23.0, which resolves the issue.
• On the 4.18.x LTS stream, upgrade to 4.18.5.
• On the 4.22.x LTS stream, upgrade to 4.22.1.

In the fixed releases the constraint matches the request path using the same case rules as dispatch, so the two can no longer disagree.

If you cannot upgrade immediately, move the authorization decision in front of the Camel consumer. A reverse proxy that normalizes the request path (including case) before forwarding is a practical stopgap. Audit any routes protected only by the camel-netty-http security constraint until the upgrade is in place.

Security Insight

This is a canonical path-confusion bug: two components parsing the same string under different rules, with the security check losing the argument. It mirrors the class of bypasses seen in reverse proxies and web frameworks where normalization happens after authorization. For Camel, which sits at the integration edge of many enterprises, it is a reminder that security constraints deserve the same conformance testing as routing.

For context on how quickly Apache middleware issues move to active exploitation, see our coverage of Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo.

Further Reading

• Apache ActiveMQ CVE-2026-34197 added to CISA KEV catalo
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs