Live › vulnerability › CVE-2026-84181
Go to dashboardThe Shiro security processor in Apache Camel skips password verification when the thread's bound subject has the same principal as the incoming exchange. Because threads are pooled, an attacker who sends a request naming an active principal can get through without valid credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that run Apache Camel with the Shiro component to authenticate exchanges are exposed. The flaw needs a request naming a principal that is currently in use, so services with busy shared principals are most at risk. Teams that do not use camel-shiro can skip it.
No product ranges from the sources yet.
camel-shiro in pom.xml or build.gradle) and compare it to the affected ranges: 4.0.0 to before 4.18.5, or 4.19.0 to before 4.22.1.alwaysReauthenticate is set to false.4.23.0, or to 4.18.5 on the 4.18.x LTS stream, or 4.22.1 on the 4.22.x LTS stream.alwaysReauthenticate=false only if the deployment depends on the old behaviour, and make sure the Shiro subject is cleared from the thread at the end of every exchange.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Authentication vulnerability in Apache Camel Shiro component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never verified. The condition depends on thread reuse and on the principal matching, which is why it is not reached on every request, but it requires nothing of the attacker beyond sending a request naming a principal that is in active use.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure the Shiro subject is cleared from the thread at the end of every exchange so that no subject can be inherited by a later one.
This page as .md · .json · in your agent: get_signal("CVE-2026-84181")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.