A critical authentication bypass flaw in the Apache Camel platform permits unauthenticated users to access sensitive management endpoints and business routes, posing a high risk of unauthorized information disclosure.

This is an authentication bypass (CWE-288) where the authentication handler only matches the exact configured context path rather than its subpaths. Consequently, unauthenticated requests to subpaths of protected routes are processed without credential challenges, exposing sensitive metadata.

The vulnerability allows attackers to bypass security controls and access sensitive management endpoints, such as the /observe/info route. This can result in the exposure of critical runtime metadata including internal process IDs, system paths, and environment details. Given the CVSS score of 8.2, this represents a significant security breach potential that could facilitate further reconnaissance and exploitation of the backend infrastructure.

Immediate Action: Update the Apache Camel component to version 4.14.6, 4.18.2, or 4.20.0 as provided in the Maven repository.

Proactive Monitoring: Review web server and application access logs for unusual patterns of unauthenticated requests targeting /api or /admin subpaths.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized attempts to access management endpoints if immediate patching is not feasible.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

This vulnerability presents a severe risk to the confidentiality of system metadata and internal application logic. Administrators must prioritize the update to the patched versions of Apache Camel, as this is the only definitive way to resolve the path-matching logic error. Failure to patch may leave your environment vulnerable to unauthorized reconnaissance and potential follow-on attacks.