Improper Authentication Vulnerability in Apache Camel Shiro Component

CVE-2026-84181

What is CVE-2026-84181?

An improper authentication vulnerability exists in the Apache Camel Shiro component that allows thread reuse to potentially bypass credential verification. When a subject is already bound to a thread and matches the principal of an incoming exchange, the system may inadvertently accept this as valid without verifying the password. This flaw is contingent on thread reuse and matching principals, thereby posing a risk every time an exchange is processed. It is recommended to upgrade to Apache Camel 4.23.0 or the specific versions 4.18.5 or 4.22.1 depending on your release stream. Until an upgrade can be performed, it is crucial to clear the Shiro subject from the thread at the end of each exchange to prevent inherited credentials from being accepted.

References