This vulnerability arises from the way Apache Camel's embedded HTTP server and management server handle authentication paths. When a non-root context path is configured and the authentication path is not explicitly set, the authentication handler matches only the exact context path, not its subpaths, due to the Vert.x sub-router mounting model. Consequently, unauthenticated requests to subpaths bypass authentication checks, reaching protected routes and management endpoints. This can lead to unauthorized access and information disclosure via endpoints like /observe/info. Affected versions include Apache Camel 4.14.1 up to but not including 4.14.6, and 4.18.0 up to but not including 4.18.2. Upgrading to 4.14.6, 4.18.2, or 4.20.0 resolves the issue.

Unauthenticated attackers can bypass authentication on subpaths of configured context paths, potentially accessing protected business routes and management endpoints without credentials. Sensitive runtime metadata such as user identity, working directory, process ID, JVM, and operating system information may be disclosed via the /observe/info endpoint. This could aid attackers in further reconnaissance or exploitation.

Users should upgrade Apache Camel to version 4.14.6 if using the 4.14.x LTS stream, to 4.18.2 if using the 4.18.x LTS stream, or to 4.20.0 or later. These versions include fixes that correctly enforce authentication on subpaths. Patch status is confirmed by the vendor advisory recommending these upgrades. No alternative mitigations are indicated.