{"id":"CVE-2026-84181","kind":"vulnerability","aliases":["CVE-2026-84181"],"related":[],"title":"Apache Camel Shiro: credentials skipped when thread reuses a bound subject","description":"Improper Authentication vulnerability in Apache Camel Shiro component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never verified. The condition depends on thread reuse and on the principal matching, which is why it is not reached on every request, but it requires nothing of the attacker beyond sending a request naming a principal that is in active use.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure the Shiro subject is cleared from the thread at the end of every exchange so that no subject can be inherited by a later one.","summary":"The Shiro security processor in Apache Camel skips password verification when the thread's bound subject has the same principal as the incoming exchange. Because threads are pooled, an attacker who sends a request naming an active principal can get through without valid credentials.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","integration","java","package","shiro"],"not_affected_if":["default-config","no-camel-shiro"],"how_to_check":"- Check the Camel version in the project's dependency files (for example `camel-shiro` in pom.xml or build.gradle) and compare it to the affected ranges: 4.0.0 to before 4.18.5, or 4.19.0 to before 4.22.1.\n- Look for uses of the Shiro security processor and check whether `alwaysReauthenticate` is set to `false`.","fix":"- Upgrade Apache Camel to `4.23.0`, or to `4.18.5` on the 4.18.x LTS stream, or `4.22.1` on the 4.22.x LTS stream.\n- If upgrading is not possible right away, set `alwaysReauthenticate=false` only if the deployment depends on the old behaviour, and make sure the Shiro subject is cleared from the thread at the end of every exchange.","status":"open","published_at":"2026-10-19T11:17:22+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:08:51+00:00","updated_at":"2026-10-25T04:08:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:08:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`, or to `4.18.5` on the 4.18.x LTS stream, or `4.22.1` on the 4.22.x LTS stream.\n- If upgrading is not possible right away, set `alwaysReauthenticate=false` only if the deployment depends on the old behaviour, and make sure the Shiro subject is cleared from the thread at the end of every exchange.","reach":"internet","title":"Apache Camel Shiro: credentials skipped when thread reuses a bound subject","impact":"high","summary":"The Shiro security processor in Apache Camel skips password verification when the thread's bound subject has the same principal as the incoming exchange. Because threads are pooled, an attacker who sends a request naming an active principal can get through without valid credentials.","category":"package","nicknames":[],"who_cares":["apache-camel","java","shiro","integration"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker bypasses password check and acts as an existing principal.","analyst_note":"","how_to_check":"- Check the Camel version in the project's dependency files (for example `camel-shiro` in pom.xml or build.gradle) and compare it to the affected ranges: 4.0.0 to before 4.18.5, or 4.19.0 to before 4.22.1.\n- Look for uses of the Shiro security processor and check whether `alwaysReauthenticate` is set to `false`.","needs_analyst":false,"not_affected_if":["no-camel-shiro","default-config"],"who_is_affected":"Applications that run Apache Camel with the Shiro component to authenticate exchanges are exposed. The flaw needs a request naming a principal that is currently in use, so services with busy shared principals are most at risk. Teams that do not use camel-shiro can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":3686,"output_tokens":659,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84181':14A,17A '4.0.0':83C '4.18':220C '4.18.5':85C,228C '4.19.0':87C '4.22':232C '4.22.1':89C,240C '4.23.0':212C 'accept':253C 'across':129C 'activ':61B,206C 'affect':79C 'alreadi':100C,256C 'alwaysreauthent':262C 'apach':1A,19B,30B,73C,80C,210C 'apache-camel':18B 'attack':54B,195C 'authent':70C,138C 'behaviour':267C 'beyond':196C 'bound':10A,39B,101C,134C,257C 'camel':2A,20B,31B,74C,81C,120C,211C 'cannot':277C 'carri':106C,118C 'case':165C 'check':143C 'clear':285C 'compon':76C 'condit':169C 'could':140C 'credenti':4A,68B,95C,152C,247C 'current':104C 'cve':12A,15A 'depend':170C,271C 'deploy':269C,275C 'drawn':123C 'earlier':137C 'end':291C 'ensur':280C 'everi':187C,249C,293C 'exchang':48B,113C,121C,130C,139C,161C,250C,294C 'fals':263C 'fix':214C 'get':64B 'immedi':279C 'improp':69C 'incom':47B,112C,160C 'inherit':301C 'integr':21B 'issu':78C,216C 'java':22B 'later':146C,304C 'left':133C 'lts':222C,234C 'match':178C 'name':59B,200C 'never':166C 'noth':192C 'one':147C,305C 'packag':23B 'password':33B,157C 'pool':52B,126C 'present':149C,246C 'previous':266C 'princip':44B,62B,109C,177C,202C 'processor':28B,93C,242C 'rather':251C 'reach':185C 'releas':223C,235C 'request':58B,188C,199C 'requir':191C 'restor':264C 'reus':8A,128C,173C 'satisfi':141C 'secur':27B,92C 'send':56B,197C 'set':261C 'shiro':3A,24B,26B,75C,91C,282C 'skip':5A,32B,94C 'stream':224C,236C 'subject':11A,40B,99C,132C,255C,283C,298C 'thread':7A,37B,50B,105C,116C,172C,260C,288C 'upgrad':208C,226C,238C,278C 'use':207C 'user':217C,229C 'valid':67B,151C 'verif':34B,96C 'verifi':167C,244C 'vulner':71C 'without':66B 'x':221C,233C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Apache Camel with the Shiro component to authenticate exchanges are exposed. The flaw needs a request naming a principal that is currently in use, so services with busy shared principals are most at risk. Teams that do not use camel-shiro can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84181","severity":null,"published_at":"2026-10-19T11:17:22+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}