CVE-2026-80312

CVE-2026-80312 is an authentication bypass in camel-oauth, the Apache Camel component that guards routes with OAuth. Apache published the advisory on 15 October 2026. The CVE record and NVD entry followed on 19 October.

When authentication could not be completed, the processors did not stop the exchange. They returned control to the route. The request then went on as if it had been authenticated.

Apache calls it a fail-open guard. An unauthenticated caller reached whatever the route did next. The advisory says it needs no special configuration and no prior access.

It only matters for routes that use camel-oauth to protect them. What an attacker can reach depends on what the protected route does.

Apache scores it CVSS 3.1 8.2 (High). NVD shows the Apache score and has not added its own.

Affected: 4.11.0 before 4.18.5, and 4.19.0 before 4.22.1. Fixed: 4.18.5, 4.22.1 and 4.23.0. The 4.14.x line is end of life; Apache says to move to 4.18.5 or later.

Before you can upgrade, Apache suggests an explicit authorization check after the OAuth processor. Then verify that the route stops when authentication fails.

The advisory credits the Claude Security Scan Tool. A public reproducer repository is published by Andrea Cosentino (oscerd), the Camel PMC member who wrote the fix. ThreatWire did not run it.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23). CISA's SSVC entry sets exploitation to none.

Read the full explainer on the eight Camel and Camel K flaws.