The vulnerability arises from the way Apache Camel's embedded HTTP server and management server handle authentication paths when a non-root context path is configured. The BasicAuthenticationConfigurer and JWTAuthenticationConfigurer derive the authentication path from the configured context path if the authentication path is not explicitly set. Due to the Vert.x sub-router mounting model, the authentication handler only matches the exact configured path, not subpaths. Consequently, unauthenticated requests to subpaths bypass authentication and can access protected business routes and management endpoints. The /observe/info endpoint can disclose sensitive runtime information such as user, working directory, process ID, JVM, and OS details. This affects Apache Camel versions 4.14.1 up to but not including 4.14.6, and 4.18.0 up to but not including 4.18.2. The issue is fixed in versions 4.14.6, 4.18.2, and 4.20.0.

Unauthenticated attackers can bypass authentication on subpaths of configured non-root context paths, gaining unauthorized access to protected business routes and management endpoints. This includes access to the /observe/info endpoint, which can disclose sensitive runtime metadata such as user identity, working directory, home directory, process ID, JVM, and operating system information. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality impact, low integrity impact, and no availability impact.

A fix is available. Users should upgrade Apache Camel to version 4.14.6 if using the 4.14.x LTS stream, to version 4.18.2 if using the 4.18.x LTS stream, or to version 4.20.0 or later. The vendor advisory from Red Hat confirms these fixed versions. No other mitigation steps are indicated or required beyond applying the official patches.