{"metadata": {"vulnerability": "cve-2026-84181", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-01T09:29:30.775Z", "date_only": false, "value": "2026-09-01T09:29:30.775Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T10:04:06Z", "date_only": false, "value": "2026-10-19T10:04:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105991", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "5f36240d-7113-4dbd-8675-9b353a71818a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Shiro #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84181\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-19 09:33:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-84181 \u2014 Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105991", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-19T10:04:06Z", "date_only": false, "value": "2026-10-19T10:04:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/105991", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "b86fbf8c-8dbc-4dce-ba6e-71baa4edf01f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Shiro #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84181\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-19 09:33:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-84181 \u2014 Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105991"}, {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "cve-2026-84181", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:43:01.181Z", "date_only": false, "value": "2026-10-19T10:43:01.181692Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117467157670071314", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "d9d2dca5-77f6-4182-afd9-ef5b7b81e8c9", "content": "CVE-2026-84181 Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse Improper Authentication vulnerability in Apache Camel Shiro component.\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\nThe Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming exchange. Because the thread that carries a Camel exchange is drawn from a pool and reused across exchanges, a subject left bound by an earlier authenticated exchange could satisfy the check for a later one that presented no valid credentials of its own. The password on the incoming exchange was, in that case, never verified. The condition depends on thread reuse and on the principal matching, which is why it is not reached on every request, but it requires nothing of the attacker beyond sending a request naming a principal that is in active use.\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processor now verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. Setting alwaysReauthenticate=false restores the previous behaviour for deployments that depend on it. For deployments that cannot upgrade immediately, ensure the Shiro subject is cleared from the thread at the end of every exchange so that no subject can be inherited by a later one.\nhttps://www.cve.org/CVERecord?id=CVE-2026-84181https://camel.apache.org/security/CVE-2026-84181.htmlhttps://issues.apache.org/jira/browse/CAMEL-24439https://github.com/apache/camel/pull/25822https://github.com/apache/camel/pull/25944https://github.com/apache/camel/pull/25946#apache #ApacheSoftwareFoundation #ApacheCamel#CVE_2026_84181#bot", "url": "https://infosec.exchange/users/cve/statuses/117467157670071314"}, {"timestamp": "2026-10-19T11:17:22Z", "date_only": false, "value": "2026-10-19T11:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XWPW-3MM7-243X", "record": "GHSA-XWPW-3MM7-243X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T11:17:22.250Z", "date_only": false, "value": "2026-10-19T11:17:22.250", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84181", "record": "FKIE_CVE-2026-84181", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T12:32:50Z", "date_only": false, "value": "2026-10-19T12:32:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XWPW-3MM7-243X", "record": "GHSA-XWPW-3MM7-243X", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T12:32:50Z", "date_only": false, "value": "2026-10-19T12:32:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XWPW-3MM7-243X", "record": "GHSA-XWPW-3MM7-243X", "field": "modified"}, {"timestamp": "2026-10-19T18:38:43.802Z", "date_only": false, "value": "2026-10-19T18:38:43.802112Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-84181", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T18:38:43.802Z", "date_only": false, "value": "2026-10-19T18:38:43.802112Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84181", "record": "FKIE_CVE-2026-84181", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-19T18:39:02.725Z", "date_only": false, "value": "2026-10-19T18:39:02.725Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:39:02.725Z", "date_only": false, "value": "2026-10-19T18:39:02.725Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-84181", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T20:45:51.597Z", "date_only": false, "value": "2026-10-19T20:45:51.597", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-84181", "record": "FKIE_CVE-2026-84181", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T20:27:25.314Z", "anchors": {"origin": {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-19T10:04:06Z", "date_only": false, "value": "2026-10-19T10:04:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105991", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "5f36240d-7113-4dbd-8675-9b353a71818a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Shiro #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84181\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-19 09:33:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-84181 \u2014 Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105991", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -1655.671, "hours": -0.45990861111111114, "days": -0.019162858796296298, "min_seconds": -1655.671, "max_seconds": -1655.671, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-19T10:04:06Z", "date_only": false, "value": "2026-10-19T10:04:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105991", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "5f36240d-7113-4dbd-8675-9b353a71818a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Shiro #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84181\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-19 09:33:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-84181 \u2014 Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105991", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1072543.643505, "hours": 297.9287898625, "days": 12.413699577604167, "min_seconds": 1072543.643505, "max_seconds": 1072543.643505, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-19T10:31:41.671Z", "date_only": false, "value": "2026-10-19T10:31:41.671Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-84181", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T20:27:25.314Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1074199.314505, "hours": 298.3886984736111, "days": 12.432862436400463, "min_seconds": 1074199.314505, "max_seconds": 1074199.314505, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-19T10:04:06Z", "date_only": false, "value": "2026-10-19T10:04:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105991", "record": "CVE-2026-84181", "field": "creation_timestamp", "uuid": "5f36240d-7113-4dbd-8675-9b353a71818a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Shiro #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-84181\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-19 09:33:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-84181 \u2014 Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105991", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-31T20:27:25.314Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}