We asked AI agents to fix real security bugs. This is what happened.

diff --git a/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java b/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
index 70cf6c1..41f85ac 100644
--- a/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
+++ b/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
@@ -41,6 +41,7 @@ import java.util.Set;
 import static io.netty.handler.codec.http.HttpHeaderNames.AUTHORIZATION;
 import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_LENGTH;
 import static io.netty.handler.codec.http.HttpHeaderNames.CONTENT_TYPE;
+import static io.netty.handler.codec.http.HttpHeaderNames.COOKIE;
 import static io.netty.handler.codec.http.HttpHeaderNames.HOST;
 import static io.netty.handler.codec.http.HttpHeaderNames.LOCATION;
 import static io.netty.handler.codec.http.HttpHeaderNames.PROXY_AUTHORIZATION;
@@ -214,6 +215,13 @@ public class Redirect30xInterceptor {
             headers.remove(AUTHORIZATION)
                     .remove(PROXY_AUTHORIZATION);
         }
+
+        // When credentials are being stripped because the redirect crosses origins or downgrades
+        // the scheme, the Cookie header (which carries session credentials) must not be propagated
+        // to the new target either, otherwise it leaks to a different origin (CWE-200).
+        if (stripAuthorization) {
+            headers.remove(COOKIE);
+        }
         return headers;
     }
 }

diff --git a/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java b/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
index 70cf6c1..308ab52 100644
--- a/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
+++ b/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java
@@ -209,10 +209,11 @@ public class Redirect30xInterceptor {
             headers.remove(CONTENT_TYPE);
         }
 
+        headers.remove(PROXY_AUTHORIZATION);
+
         if (stripAuthorization || (realm != null && (realm.getScheme() == AuthScheme.NTLM
                 || realm.getScheme() == AuthScheme.SCRAM_SHA_256))) {
-            headers.remove(AUTHORIZATION)
-                    .remove(PROXY_AUTHORIZATION);
+            headers.remove(AUTHORIZATION);
         }
         return headers;
     }
diff --git a/client/src/test/java/org/asynchttpclient/StripAuthorizationOnRedirectHttpTest.java b/client/src/test/java/org/asynchttpclient/StripAuthorizationOnRedirectHttpTest.java
index 08c150c..9a58b4a 100644
--- a/client/src/test/java/org/asynchttpclient/StripAuthorizationOnRedirectHttpTest.java
+++ b/client/src/test/java/org/asynchttpclient/StripAuthorizationOnRedirectHttpTest.java
@@ -17,6 +17,7 @@ public class StripAuthorizationOnRedirectHttpTest {
     private static HttpServer server;
     private static int port;
     private static volatile String lastAuthHeader;
+    private static volatile String lastProxyAuthHeader;
 
     @BeforeAll
     public static void startServer() throws Exception {
@@ -37,6 +38,7 @@ public class StripAuthorizationOnRedirectHttpTest {
         public void handle(HttpExchange exchange) {
             String auth = exchange.getRequestHeaders().getFirst("Authorization");
             lastAuthHeader = auth;
+            lastProxyAuthHeader = exchange.getRequestHeaders().getFirst("Proxy-Authorization");
             exchange.getResponseHeaders().add("Location", "http://localhost:" + port + "/final");
             try {
                 exchange.sendResponseHeaders(302, -1);
@@ -51,6 +53,7 @@ public class StripAuthorizationOnRedirectHttpTest {
         public void handle(HttpExchange exchange) {
             String auth = exchange.getRequestHeaders().getFirst("Authorization");
             lastAuthHeader = auth;
+            lastProxyAuthHeader = exchange.getRequestHeaders().getFirst("Proxy-Authorization");
             try {
                 exchange.sendResponseHeaders(200, 0);
                 exchange.getResponseBody().close();
@@ -92,4 +95,19 @@ public class StripAuthorizationOnRedirectHttpTest {
             assertNull(lastAuthHeader, "Authorization header should be stripped on redirect when enabled");
         }
     }
+
+    @Test
+    void testProxyAuthHeaderStrippedByDefault() throws Exception {
+        DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
+                .setFollowRedirect(true)
+                .build();
+        try (DefaultAsyncHttpClient client = new DefaultAsyncHttpClient(config)) {
+            lastProxyAuthHeader = null;
+            client.prepareGet("http://localhost:" + port + "/redirect")
+                    .setHeader("Proxy-Authorization", "Basic cHJveHk6cGFzcw==")
+                    .execute()
+                    .get(5, TimeUnit.SECONDS);
+            assertNull(lastProxyAuthHeader, "Proxy-Authorization header must not be propagated on redirect");
+        }
+    }
 }

diff --git a/src/ui/mcp-ui-utils.ts b/src/ui/mcp-ui-utils.ts
index d591588..db54ca9 100644
--- a/src/ui/mcp-ui-utils.ts
+++ b/src/ui/mcp-ui-utils.ts
@@ -7,6 +7,25 @@
  * Reference: https://mcpui.dev/guide/introduction
  */
 
+/**
+ * Escapes a string for safe interpolation into HTML markup.
+ *
+ * Encodes the characters that are significant in HTML so that
+ * attacker/device-controlled values cannot break out of text or attribute
+ * contexts and inject markup or script (CWE-79).
+ *
+ * @param value - Arbitrary value to escape (coerced to string)
+ * @returns HTML-escaped string
+ */
+function escapeHtml(value: unknown): string {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 /**
  * Creates a UIResource object following MCP-UI protocol
  * @param uri - Unique identifier using ui:// scheme (e.g., 'ui://appium-mcp/device-picker')
@@ -720,24 +739,24 @@ export function createLocatorGeneratorUI(
       (element, index) => `
     <div class="locator-card" data-index="${index}">
       <div class="locator-header">
-        <h3>${element.tagName}</h3>
+        <h3>${escapeHtml(element.tagName)}</h3>
         <div class="badges">
           ${element.clickable ? '<span class="badge badge-clickable">Clickable</span>' : ''}
           ${element.enabled ? '<span class="badge badge-enabled">Enabled</span>' : ''}
           ${element.displayed ? '<span class="badge badge-displayed">Displayed</span>' : ''}
         </div>
       </div>
-      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${element.text}</p>` : ''}
-      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${element.contentDesc}</p>` : ''}
-      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${element.resourceId}</code></p>` : ''}
+      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${escapeHtml(element.text)}</p>` : ''}
+      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${escapeHtml(element.contentDesc)}</p>` : ''}
+      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${escapeHtml(element.resourceId)}</code></p>` : ''}
       <div class="locators-list">
         ${Object.entries(element.locators)
           .map(
             ([strategy, selector]) => `
           <div class="locator-item">
-            <span class="strategy">${strategy}</span>
-            <code class="selector">${selector}</code>
-            <button class="test-btn" onclick="testLocator('${strategy}', \`${selector.replace(/`/g, '\\`')}\`)">Test</button>
+            <span class="strategy">${escapeHtml(strategy)}</span>
+            <code class="selector">${escapeHtml(selector)}</code>
+            <button class="test-btn" data-strategy="${escapeHtml(strategy)}" data-selector="${escapeHtml(selector)}">Test</button>
           </div>
         `
           )
@@ -895,6 +914,14 @@ export function createLocatorGeneratorUI(
         }
       }, '*');
     }
+
+    // Wire up Test buttons via data attributes so locator values are never
+    // interpolated into executable markup (prevents XSS).
+    document.querySelectorAll('.test-btn').forEach(function (button) {
+      button.addEventListener('click', function () {
+        testLocator(button.dataset.strategy, button.dataset.selector);
+      });
+    });
   </script>
 </body>
 </html>

diff --git a/src/tests/ui-mcp-utils.test.ts b/src/tests/ui-mcp-utils.test.ts
new file mode 100644
index 0000000..d37f69d
--- /dev/null
+++ b/src/tests/ui-mcp-utils.test.ts
@@ -0,0 +1,93 @@
+import { describe, expect, test } from '@jest/globals';
+
+import {
+  addUIResourceToResponse,
+  createLocatorGeneratorUI,
+  createUIResource,
+} from '../ui/mcp-ui-utils.js';
+
+describe('mcp ui utilities', () => {
+  test('createLocatorGeneratorUI escapes locator metadata and selectors', () => {
+    const html = createLocatorGeneratorUI([
+      {
+        tagName: 'button"><script>alert(1)</script>',
+        text: '<img src=x onerror=alert(2)>',
+        contentDesc: '</p><script>alert(3)</script>',
+        resourceId: 'app:id/" onclick="alert(4)',
+        locators: {
+          'accessibility id': '`);alert(5);//',
+          xpath: `//*[@text="</code><script>alert(6)</script>"]`,
+        },
+        clickable: true,
+        enabled: true,
+        displayed: true,
+      },
+    ]);
+
+    expect(html).toContain(
+      'button&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;'
+    );
+    expect(html).toContain('&lt;img src=x onerror=alert(2)&gt;');
+    expect(html).toContain('&lt;/p&gt;&lt;script&gt;alert(3)&lt;/script&gt;');
+    expect(html).toContain('app:id/&quot; onclick=&quot;alert(4)');
+    expect(html).toContain(
+      '//*[@text=&quot;&lt;/code&gt;&lt;script&gt;alert(6)&lt;/script&gt;&quot;]'
+    );
+    expect(html).not.toContain('<script>alert(1)</script>');
+    expect(html).not.toContain('<img src=x onerror=alert(2)>');
+    expect(html).not.toContain('</p><script>alert(3)</script>');
+    expect(html).not.toContain('</code><script>alert(6)</script>');
+    expect(html).not.toContain('onclick="testLocator');
+  });
+
+  test('createLocatorGeneratorUI uses nonce-protected script instead of inline handlers', () => {
+    const html = createLocatorGeneratorUI([
+      {
+        tagName: 'Button',
+        text: 'Save',
+        contentDesc: '',
+        resourceId: 'app:id/save',
+        locators: {
+          id: 'app:id/save',
+        },
+        clickable: true,
+        enabled: true,
+        displayed: true,
+      },
+    ]);
+
+    expect(html).toMatch(
+      /Content-Security-Policy" content="[^"]*script-src 'nonce-[^']+'/
+    );
+    expect(html).toMatch(/<script nonce="[^"]+">/);
+    expect(html).toContain('data-strategy="id"');
+    expect(html).toContain('data-selector="app:id/save"');
+    expect(html).toContain("button.dataset.strategy || ''");
+    expect(html).not.toContain('onclick=');
+  });
+
+  test('addUIResourceToResponse preserves text response content and appends UI resource', () => {
+    const response = { content: [{ type: 'text', text: 'ok' }] };
+    const uiResource = createUIResource('ui://appium-mcp/test', '<p>ok</p>');
+
+    expect(addUIResourceToResponse(response, uiResource)).toEqual({
+      content: [{ type: 'text', text: 'ok' }, uiResource],
+    });
+  });
+
+  test('addUIResourceToResponse rejects malformed UI resources', () => {
+    const response = { content: [{ type: 'text', text: 'ok' }] };
+
+    expect(addUIResourceToResponse(response, null as never)).toBe(response);
+    expect(
+      addUIResourceToResponse(response, {
+        type: 'resource',
+        resource: {
+          uri: 'ui://appium-mcp/test',
+          mimeType: 'application/json',
+          text: '<script>alert(1)</script>',
+        },
+      } as never)
+    ).toBe(response);
+  });
+});
diff --git a/src/ui/mcp-ui-utils.ts b/src/ui/mcp-ui-utils.ts
index d591588..f1a32df 100644
--- a/src/ui/mcp-ui-utils.ts
+++ b/src/ui/mcp-ui-utils.ts
@@ -6,6 +6,20 @@
  *
  * Reference: https://mcpui.dev/guide/introduction
  */
+import { randomBytes } from 'node:crypto';
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+function createCspNonce(): string {
+  return randomBytes(16).toString('base64');
+}
 
 /**
  * Creates a UIResource object following MCP-UI protocol
@@ -34,6 +48,17 @@ export function createUIResource(
   };
 }
 
+function isHtmlUIResource(
+  uiResource: ReturnType<typeof createUIResource>
+): boolean {
+  return (
+    uiResource?.type === 'resource' &&
+    uiResource.resource?.mimeType === 'text/html' &&
+    typeof uiResource.resource.uri === 'string' &&
+    typeof uiResource.resource.text === 'string'
+  );
+}
+
 /**
  * Creates a device picker UI component
  * @param devices - Array of device objects with name, udid, state, etc.
@@ -715,37 +740,46 @@ export function createLocatorGeneratorUI(
     displayed: boolean;
   }>
 ): string {
+  const scriptNonce = createCspNonce();
   const locatorCards = locators
-    .map(
-      (element, index) => `
+    .map((element, index) => {
+      const tagName = escapeHtml(element.tagName);
+      const text = escapeHtml(element.text);
+      const contentDesc = escapeHtml(element.contentDesc);
+      const resourceId = escapeHtml(element.resourceId);
+
+      return `
     <div class="locator-card" data-index="${index}">
       <div class="locator-header">
-        <h3>${element.tagName}</h3>
+        <h3>${tagName}</h3>
         <div class="badges">
           ${element.clickable ? '<span class="badge badge-clickable">Clickable</span>' : ''}
           ${element.enabled ? '<span class="badge badge-enabled">Enabled</span>' : ''}
           ${element.displayed ? '<span class="badge badge-displayed">Displayed</span>' : ''}
         </div>
       </div>
-      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${element.text}</p>` : ''}
-      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${element.contentDesc}</p>` : ''}
-      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${element.resourceId}</code></p>` : ''}
+      ${element.text ? `<p class="element-text"><strong>Text:</strong> ${text}</p>` : ''}
+      ${element.contentDesc ? `<p class="element-text"><strong>Content Desc:</strong> ${contentDesc}</p>` : ''}
+      ${element.resourceId ? `<p class="element-text"><strong>Resource ID:</strong> <code>${resourceId}</code></p>` : ''}
       <div class="locators-list">
         ${Object.entries(element.locators)
-          .map(
-            ([strategy, selector]) => `
+          .map(([strategy, selector]) => {
+            const escapedStrategy = escapeHtml(strategy);
+            const escapedSelector = escapeHtml(selector);
+
+            return `
           <div class="locator-item">
-            <span class="strategy">${strategy}</span>
-            <code class="selector">${selector}</code>
-            <button class="test-btn" onclick="testLocator('${strategy}', \`${selector.replace(/`/g, '\\`')}\`)">Test</button>
+            <span class="strategy">${escapedStrategy}</span>
+            <code class="selector">${escapedSelector}</code>
+            <button class="test-btn" type="button" data-strategy="${escapedStrategy}" data-selector="${escapedSelector}">Test</button>
           </div>
-        `
-          )
+        `;
+          })
           .join('')}
       </div>
     </div>
-  `
-    )
+  `;
+    })
     .join('');
 
   return `
@@ -754,6 +788,7 @@ export function createLocatorGeneratorUI(
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${scriptNonce}'; base-uri 'none'; form-action 'none'">
   <title>Locator Generator</title>
   <style>
     * {
@@ -882,7 +917,7 @@ export function createLocatorGeneratorUI(
       ${locators.length > 0 ? locatorCards : '<p>No locators found</p>'}
     </div>
   </div>
-  <script>
+  <script nonce="${scriptNonce}">
     function testLocator(strategy, selector) {
       window.parent.postMessage({
         type: 'tool',
@@ -895,6 +930,15 @@ export function createLocatorGeneratorUI(
         }
       }, '*');
     }
+
+    document.querySelector('.locators-grid').addEventListener('click', (event) => {
+      const button = event.target instanceof HTMLElement ? event.target.closest('.test-btn') : null;
+      if (!(button instanceof HTMLButtonElement)) {
+        return;
+      }
+
+      testLocator(button.dataset.strategy || '', button.dataset.selector || '');
+    });
   </script>
 </body>
 </html>
@@ -1629,6 +1673,10 @@ export function addUIResourceToResponse(
     return response;
   }
 
+  if (!isHtmlUIResource(uiResource)) {
+    return response;
+  }
+
   return {
     content: [...response.content, uiResource],
   };

diff --git a/internal/api/delete.go b/internal/api/delete.go
index f6f7f3d..d55e761 100644
--- a/internal/api/delete.go
+++ b/internal/api/delete.go
@@ -472,6 +472,17 @@ func (h *DeleteHandler) validateWhereClause(where string) (bool, error) {
 		}
 	}
 
+	// SECURITY: reject DuckDB file-reading functions (read_csv, read_text,
+	// read_blob, glob, parquet_scan, …). The WHERE clause is interpolated
+	// into `read_parquet('<file>') WHERE NOT (<where>)`, so a scalar call
+	// like `length(read_blob('/etc/passwd')) >= 0` reads arbitrary local
+	// files (CWE-22 path traversal) without tripping any of the keyword
+	// checks above, none of these functions are SQL keywords. Legitimate
+	// delete predicates only reference columns, so this is safe to reject.
+	if userSQLFileFunctionPattern.MatchString(where) {
+		return false, fmt.Errorf("WHERE clause contains forbidden file-reading function")
+	}
+
 	// Check for unmatched quotes
 	if strings.Count(where, "'")%2 != 0 {
 		return false, fmt.Errorf("WHERE clause has unmatched quotes")
diff --git a/internal/api/query.go b/internal/api/query.go
index a1dbc58..1d8f392 100644
--- a/internal/api/query.go
+++ b/internal/api/query.go
@@ -720,6 +720,17 @@ func validateWhereClauseQuery(where string) error {
 		}
 	}
 
+	// SECURITY: reject DuckDB file-reading functions (read_csv, read_text,
+	// read_blob, glob, parquet_scan, …). This WHERE clause is interpolated
+	// into `... FROM db.measurement WHERE <where>` which is then rewritten
+	// to a read_parquet() query, so a scalar call such as
+	// `length(read_blob('/etc/passwd')) >= 0` performs an arbitrary local
+	// file read (CWE-22 path traversal), none of these functions are SQL
+	// keywords, so the keyword denylist above does not catch them.
+	if userSQLFileFunctionPattern.MatchString(where) {
+		return fmt.Errorf("where clause contains forbidden file-reading function")
+	}
+
 	// Check for unmatched quotes
 	if strings.Count(where, "'")%2 != 0 {
 		return fmt.Errorf("where clause has unmatched single quotes")
@@ -1859,6 +1870,23 @@ func ValidateSQLRequest(sql string) error {
 		return &SQLValidationError{Message: "Direct read_parquet() calls are not allowed in user SQL"}
 	}
 
+	// SECURITY: reject user SQL that calls any DuckDB file-reading table
+	// function directly. Blocking read_parquet alone (above) is not enough:
+	// DuckDB exposes a whole family of functions, read_csv, read_csv_auto,
+	// read_json[_auto], read_ndjson, read_text, read_blob, parquet_scan,
+	// parquet_metadata/schema, glob, sniff_csv, delta_scan, iceberg_scan,
+	// etc., that read arbitrary filesystem (and remote) paths *directly*,
+	// bypassing the storage backend and its path-traversal guards. Without
+	// this block a query like `SELECT * FROM read_csv_auto('/etc/passwd')`
+	// or `SELECT content FROM read_text('/data/db2/secrets/...')` performs
+	// arbitrary local file reads (CWE-22 path traversal) and routes around
+	// the table-name → storage-path mapping that RBAC depends on. Arc's own
+	// query rewriter only ever emits read_parquet (handled specially), so
+	// any of these functions in user input is illegitimate.
+	if userSQLFileFunctionPattern.MatchString(normalised) {
+		return &SQLValidationError{Message: "Direct file-reading function calls are not allowed in user SQL"}
+	}
+
 	// SECURITY: reject user SQL that calls arcx's table functions
 	// directly. arc_partition_agg(db, m, unit) takes raw database and
 	// measurement strings and globs the filesystem; without this block,
@@ -1884,6 +1912,18 @@ var userSQLReadParquetPattern = regexp.MustCompile(`(?i)\bread_parquet\s*\(`)
 // must route through Arc's rewriter so RBAC stays load-bearing.
 var userSQLArcPartitionAggPattern = regexp.MustCompile(`(?i)\barc_partition_agg\s*\(`)
 
+// userSQLFileFunctionPattern matches any DuckDB file-reading function
+// call (case-insensitive, allowing whitespace before the open paren).
+// These functions read arbitrary filesystem/remote paths directly,
+// bypassing the storage backend's path-traversal validation, so they
+// must never appear in user-supplied SQL. `read_\w+` covers the whole
+// read_* reader family (read_csv, read_csv_auto, read_json, read_ndjson,
+// read_text, read_blob, read_parquet, …); the remaining alternatives
+// cover readers that do not share the read_ prefix. Only runs against
+// masked/comment-stripped SQL so a string literal or comment mentioning
+// one of these names does not false-positive.
+var userSQLFileFunctionPattern = regexp.MustCompile(`(?i)\b(?:read_\w+|parquet_scan|parquet_metadata|parquet_schema|parquet_file_metadata|parquet_kv_metadata|parquet_bloom_probe|glob|sniff_csv|delta_scan|iceberg_scan|iceberg_metadata|iceberg_snapshots|scan_arrow_ipc)\s*\(`)
+
 // getTransformedSQL returns the transformed SQL with caching.
 // If headerDB is non-empty, uses the optimized path with that database for all tables.
 // Returns the transformed SQL and whether it was a cache hit.

diff --git a/internal/api/delete.go b/internal/api/delete.go
index f6f7f3d..16ca7cd 100644
--- a/internal/api/delete.go
+++ b/internal/api/delete.go
@@ -64,6 +64,36 @@ func fileMetadata(path string) (sizeBytes int64, sha256hex string, err error) {
 	return n, fmt.Sprintf("%x", h.Sum(nil)), nil
 }
 
+func resolveLocalStoragePath(basePath, relativePath string) (string, error) {
+	if filepath.IsAbs(relativePath) {
+		return "", fmt.Errorf("path must be relative: %s", relativePath)
+	}
+	fullPath, err := filepath.Abs(filepath.Join(basePath, relativePath))
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve path: %w", err)
+	}
+	return ensurePathWithinBase(basePath, fullPath)
+}
+
+func ensurePathWithinBase(basePath, path string) (string, error) {
+	absBase, err := filepath.Abs(basePath)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve storage root: %w", err)
+	}
+	absPath, err := filepath.Abs(path)
+	if err != nil {
+		return "", fmt.Errorf("failed to resolve path: %w", err)
+	}
+	rel, err := filepath.Rel(absBase, absPath)
+	if err != nil {
+		return "", fmt.Errorf("path escapes storage root: %w", err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("path escapes storage root: %s", path)
+	}
+	return absPath, nil
+}
+
 // freeOSMemoryProcessStart anchors the throttle to the monotonic clock so wall
 // clock adjustments (NTP steps, manual `date` changes) cannot misbehave.
 var freeOSMemoryProcessStart = time.Now()
@@ -228,18 +258,16 @@ func (h *DeleteHandler) handleDelete(c *fiber.Ctx) error {
 		})
 	}
 
-	// Reject path traversal in database/measurement names, these values are
-	// concatenated directly into storage prefixes and DuckDB paths.
-	if strings.ContainsAny(req.Database, "/\\") || strings.Contains(req.Database, "..") {
+	if !isValidDatabaseName(req.Database) {
 		return c.Status(fiber.StatusBadRequest).JSON(DeleteResponse{
 			Success: false,
-			Error:   "database name contains invalid characters",
+			Error:   "invalid database name: must start with a letter and contain only alphanumeric characters, underscores, or hyphens (max 64 characters)",
 		})
 	}
-	if strings.ContainsAny(req.Measurement, "/\\") || strings.Contains(req.Measurement, "..") {
+	if !isValidMeasurementName(req.Measurement) {
 		return c.Status(fiber.StatusBadRequest).JSON(DeleteResponse{
 			Success: false,
-			Error:   "measurement name contains invalid characters",
+			Error:   "invalid measurement name: must start with a letter and contain only alphanumeric characters, underscores, or hyphens",
 		})
 	}
 
@@ -464,7 +492,6 @@ func (h *DeleteHandler) validateWhereClause(where string) (bool, error) {
 		return false, fmt.Errorf("WHERE clause contains forbidden keyword: %s", strings.ToUpper(match))
 	}
 
-
 	// Check for dangerous prefixes
 	for _, pattern := range dangerousPrefixPatterns {
 		if strings.Contains(whereUpper, pattern) {
@@ -508,8 +535,12 @@ func (h *DeleteHandler) findAffectedFiles(ctx context.Context, database, measure
 	var parquetFiles []fileInfo
 	for _, f := range files {
 		if strings.HasSuffix(strings.ToLower(f), ".parquet") {
+			queryPath, err := h.getQueryPath(f)
+			if err != nil {
+				return nil, err
+			}
 			parquetFiles = append(parquetFiles, fileInfo{
-				queryPath:    h.getQueryPath(f),
+				queryPath:    queryPath,
 				relativePath: f,
 			})
 		}
@@ -728,6 +759,13 @@ func (h *DeleteHandler) rewriteFileWithoutDeletedRows(ctx context.Context, query
 func (h *DeleteHandler) rewriteLocalFile(ctx context.Context, filePath, _, whereClause string, rowsBefore, rowsAfter int64) (int64, error) {
 	db := h.db.DB()
 	deleted := rowsBefore - rowsAfter
+	if lb, ok := h.storage.(*storage.LocalBackend); ok {
+		var err error
+		filePath, err = ensurePathWithinBase(lb.GetBasePath(), filePath)
+		if err != nil {
+			return 0, err
+		}
+	}
 
 	// Create temp file for the rewritten data
 	dir := filepath.Dir(filePath)
@@ -856,16 +894,16 @@ func (h *DeleteHandler) rewriteS3File(ctx context.Context, s3Path, relativePath,
 }
 
 // getQueryPath converts a storage-relative path to a DuckDB-compatible path
-func (h *DeleteHandler) getQueryPath(relativePath string) string {
+func (h *DeleteHandler) getQueryPath(relativePath string) (string, error) {
 	switch backend := h.storage.(type) {
 	case *storage.LocalBackend:
-		return filepath.Join(backend.GetBasePath(), relativePath)
+		return resolveLocalStoragePath(backend.GetBasePath(), relativePath)
 	case *storage.S3Backend:
-		return fmt.Sprintf("s3://%s/%s%s", backend.GetBucket(), backend.GetPrefix(), relativePath)
+		return fmt.Sprintf("s3://%s/%s%s", backend.GetBucket(), backend.GetPrefix(), relativePath), nil
 	case *storage.AzureBlobBackend:
-		return fmt.Sprintf("azure://%s/%s", backend.GetContainer(), relativePath)
+		return fmt.Sprintf("azure://%s/%s", backend.GetContainer(), relativePath), nil
 	default:
-		return relativePath
+		return relativePath, nil
 	}
 }
 
@@ -902,11 +940,9 @@ func (h *DeleteHandler) updateManifestAfterRewrite(relativePath string, s3 *s3Re
 
 	if lb, ok := h.storage.(*storage.LocalBackend); ok {
 		basePath := lb.GetBasePath()
-		fullPath := filepath.Join(basePath, relativePath)
-		// Containment check: relativePath is already validated upstream, but
-		// guard here too since fileMetadata opens the file for reading.
-		if !strings.HasPrefix(fullPath, basePath+string(filepath.Separator)) {
-			return fmt.Errorf("path escapes storage root: %s", relativePath)
+		fullPath, err := resolveLocalStoragePath(basePath, relativePath)
+		if err != nil {
+			return err
 		}
 		size, sha, err := fileMetadata(fullPath)
 		if err != nil {
diff --git a/internal/api/delete_test.go b/internal/api/delete_test.go
new file mode 100644
index 0000000..e1d6c41
--- /dev/null
+++ b/internal/api/delete_test.go
@@ -0,0 +1,51 @@
+package api
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveLocalStoragePathAllowsPathInsideBase(t *testing.T) {
+	base := t.TempDir()
+
+	got, err := resolveLocalStoragePath(base, "db/cpu/2026/06/30/00/data.parquet")
+	if err != nil {
+		t.Fatalf("resolveLocalStoragePath returned error: %v", err)
+	}
+
+	want := filepath.Join(base, "db", "cpu", "2026", "06", "30", "00", "data.parquet")
+	if got != want {
+		t.Fatalf("resolved path = %q, want %q", got, want)
+	}
+}
+
+func TestResolveLocalStoragePathRejectsTraversal(t *testing.T) {
+	base := t.TempDir()
+
+	tests := []string{
+		"../outside.parquet",
+		"db/../../outside.parquet",
+		filepath.Join(base, "..", "outside.parquet"),
+	}
+
+	for _, input := range tests {
+		t.Run(input, func(t *testing.T) {
+			if got, err := resolveLocalStoragePath(base, input); err == nil {
+				t.Fatalf("resolveLocalStoragePath(%q) = %q, want error", input, got)
+			}
+		})
+	}
+}
+
+func TestEnsurePathWithinBaseRejectsSiblingPrefix(t *testing.T) {
+	root := t.TempDir()
+	base := filepath.Join(root, "data")
+	sibling := filepath.Join(root, "database", "file.parquet")
+
+	if got, err := ensurePathWithinBase(base, sibling); err == nil {
+		t.Fatalf("ensurePathWithinBase returned %q, want sibling rejection", got)
+	} else if !strings.Contains(err.Error(), "escapes storage root") {
+		t.Fatalf("error = %q, want storage-root escape error", err.Error())
+	}
+}
diff --git a/internal/database/duckdb.go b/internal/database/duckdb.go
index 40318b9..645d362 100644
--- a/internal/database/duckdb.go
+++ b/internal/database/duckdb.go
@@ -54,10 +54,10 @@ func escapeSQLString(s string) string {
 // URLs that fail to resolve.
 //
 // Strips, in order:
-//  - leading and trailing whitespace (paste artefacts),
-//  - leading "http://" or "https://" (case-insensitive, RFC 3986 schemes
-//    are case-insensitive and users routinely paste mixed-case),
-//  - trailing slashes ("host:port/" → "host:port").
+//   - leading and trailing whitespace (paste artefacts),
+//   - leading "http://" or "https://" (case-insensitive, RFC 3986 schemes
+//     are case-insensitive and users routinely paste mixed-case),
+//   - trailing slashes ("host:port/" → "host:port").
 //
 // The case of the remainder is preserved (bucket names and path components
 // can be case-sensitive depending on the S3 implementation).
@@ -773,7 +773,7 @@ func (d *DuckDB) QueryWithProfileContext(ctx context.Context, query string) (*sq
 	if _, err := conn.ExecContext(ctx, "PRAGMA enable_profiling='json'"); err != nil {
 		d.logger.Warn().Err(err).Msg("Failed to enable profiling")
 	}
-	if _, err := conn.ExecContext(ctx, fmt.Sprintf("PRAGMA profiling_output='%s'", profilePath)); err != nil {
+	if _, err := conn.ExecContext(ctx, fmt.Sprintf("PRAGMA profiling_output='%s'", escapeSQLString(profilePath))); err != nil {
 		d.logger.Warn().Err(err).Msg("Failed to set profiling output")
 	}
 	// Enable planner timing metrics
diff --git a/internal/database/duckdb_arrow.go b/internal/database/duckdb_arrow.go
index 6a1094c..62ea3f1 100644
--- a/internal/database/duckdb_arrow.go
+++ b/internal/database/duckdb_arrow.go
@@ -100,7 +100,7 @@ func (d *DuckDB) ArrowQueryWithProfileContext(ctx context.Context, query string)
 	if _, err := conn.ExecContext(ctx, "PRAGMA enable_profiling='json'"); err != nil {
 		d.logger.Warn().Err(err).Msg("Failed to enable profiling")
 	}
-	if _, err := conn.ExecContext(ctx, fmt.Sprintf("PRAGMA profiling_output='%s'", profilePath)); err != nil {
+	if _, err := conn.ExecContext(ctx, fmt.Sprintf("PRAGMA profiling_output='%s'", escapeSQLString(profilePath))); err != nil {
 		d.logger.Warn().Err(err).Msg("Failed to set profiling output")
 	}
 	if _, err := conn.ExecContext(ctx, "SET custom_profiling_settings='{\"PLANNER\": \"true\", \"PLANNER_BINDING\": \"true\", \"PHYSICAL_PLANNER\": \"true\", \"OPERATOR_TIMING\": \"true\", \"OPERATOR_CARDINALITY\": \"true\"}'"); err != nil {

diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
index bef37925..b7510999 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
@@ -35,12 +35,9 @@ public class BasicAuthenticationConfigurer implements MainAuthenticationConfigur
             AuthenticationConfig authenticationConfig,
             HttpServerConfigurationProperties properties) {
         String authPropertiesFileName = properties.getBasicPropertiesFile();
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
+        // ensure the path protects the configured path and everything below it (CWE-288)
+        String path = MainAuthenticationConfigurer.toAuthenticationPath(
+                isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath());
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : DEFAULT_REALM;
 
         AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
@@ -64,12 +61,9 @@ public class BasicAuthenticationConfigurer implements MainAuthenticationConfigur
             AuthenticationConfig authenticationConfig,
             HttpManagementServerConfigurationProperties properties) {
         String authPropertiesFileName = properties.getBasicPropertiesFile();
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
+        // ensure the path protects the configured path and everything below it (CWE-288)
+        String path = MainAuthenticationConfigurer.toAuthenticationPath(
+                isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath());
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : DEFAULT_REALM;
 
         AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
index 61616107..61e962df 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
@@ -37,12 +37,9 @@ public class JWTAuthenticationConfigurer implements MainAuthenticationConfigurer
             AuthenticationConfig authenticationConfig,
             HttpServerConfigurationProperties properties) {
 
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
+        // ensure the path protects the configured path and everything below it (CWE-288)
+        String path = MainAuthenticationConfigurer.toAuthenticationPath(
+                isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath());
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : null;
 
         AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
@@ -72,12 +69,9 @@ public class JWTAuthenticationConfigurer implements MainAuthenticationConfigurer
             AuthenticationConfig authenticationConfig,
             HttpManagementServerConfigurationProperties properties) {
 
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
+        // ensure the path protects the configured path and everything below it (CWE-288)
+        String path = MainAuthenticationConfigurer.toAuthenticationPath(
+                isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath());
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : null;
 
         AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
index 72011adc..84c0fec6 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
@@ -30,4 +30,27 @@ public interface MainAuthenticationConfigurer {
     void configureAuthentication(
             AuthenticationConfig authenticationConfig, HttpManagementServerConfigurationProperties properties);
 
+    /**
+     * Normalizes the configured authentication path into a wildcard pattern so that authentication is applied to the
+     * configured path <em>and everything beneath it</em>.
+     * <p>
+     * Without this, a non-wildcard path (such as the server context-path or an explicitly configured
+     * {@code authenticationPath}) is registered as an exact-match route, leaving every sub-path reachable without
+     * authentication. That is an authentication bypass using an alternate path (CWE-288).
+     *
+     * @param  path the configured authentication path (may be {@code null} or empty)
+     * @return      a wildcard path that protects the configured path and all sub-paths
+     */
+    static String toAuthenticationPath(String path) {
+        if (path == null || path.isEmpty()) {
+            // protect everything when no path is configured
+            return "/*";
+        }
+        if (!path.endsWith("*")) {
+            // turn the path into a prefix match so sub-paths are also authenticated
+            path = path + "*";
+        }
+        return path;
+    }
+
 }

diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
index bef37925..6251ef8c 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/BasicAuthenticationConfigurer.java
@@ -21,12 +21,10 @@ import io.vertx.ext.auth.properties.PropertyFileAuthentication;
 import io.vertx.ext.web.handler.AuthenticationHandler;
 import io.vertx.ext.web.handler.BasicAuthHandler;
 import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig;
-import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationConfigEntry;
 import org.apache.camel.main.HttpManagementServerConfigurationProperties;
 import org.apache.camel.main.HttpServerConfigurationProperties;
 
 import static io.vertx.ext.web.handler.BasicAuthHandler.DEFAULT_REALM;
-import static org.apache.camel.util.ObjectHelper.isNotEmpty;
 
 public class BasicAuthenticationConfigurer implements MainAuthenticationConfigurer {
 
@@ -35,28 +33,17 @@ public class BasicAuthenticationConfigurer implements MainAuthenticationConfigur
             AuthenticationConfig authenticationConfig,
             HttpServerConfigurationProperties properties) {
         String authPropertiesFileName = properties.getBasicPropertiesFile();
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : DEFAULT_REALM;
 
-        AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
-        entry.setPath(path);
-        entry.setAuthenticationHandlerFactory(new AuthenticationConfig.AuthenticationHandlerFactory() {
-            @Override
-            public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
-                    T authenticationProvider) {
-                return BasicAuthHandler.create(authenticationProvider, realm);
-            }
-        });
-        entry.setAuthenticationProviderFactory(
-                vertx -> PropertyFileAuthentication.create(vertx, authPropertiesFileName));
-
-        authenticationConfig.getEntries().add(entry);
-        authenticationConfig.setEnabled(true);
+        addAuthenticationConfigEntries(authenticationConfig, properties.getAuthenticationPath(), properties.getPath(),
+                vertx -> PropertyFileAuthentication.create(vertx, authPropertiesFileName),
+                new AuthenticationConfig.AuthenticationHandlerFactory() {
+                    @Override
+                    public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
+                            T authenticationProvider) {
+                        return BasicAuthHandler.create(authenticationProvider, realm);
+                    }
+                });
     }
 
     @Override
@@ -64,27 +51,16 @@ public class BasicAuthenticationConfigurer implements MainAuthenticationConfigur
             AuthenticationConfig authenticationConfig,
             HttpManagementServerConfigurationProperties properties) {
         String authPropertiesFileName = properties.getBasicPropertiesFile();
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : DEFAULT_REALM;
 
-        AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
-        entry.setPath(path);
-        entry.setAuthenticationHandlerFactory(new AuthenticationConfig.AuthenticationHandlerFactory() {
-            @Override
-            public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
-                    T authenticationProvider) {
-                return BasicAuthHandler.create(authenticationProvider, realm);
-            }
-        });
-        entry.setAuthenticationProviderFactory(
-                vertx -> PropertyFileAuthentication.create(vertx, authPropertiesFileName));
-
-        authenticationConfig.getEntries().add(entry);
-        authenticationConfig.setEnabled(true);
+        addAuthenticationConfigEntries(authenticationConfig, properties.getAuthenticationPath(), properties.getPath(),
+                vertx -> PropertyFileAuthentication.create(vertx, authPropertiesFileName),
+                new AuthenticationConfig.AuthenticationHandlerFactory() {
+                    @Override
+                    public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
+                            T authenticationProvider) {
+                        return BasicAuthHandler.create(authenticationProvider, realm);
+                    }
+                });
     }
 }
diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
index 61616107..b55f0f20 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java
@@ -23,13 +23,10 @@ import io.vertx.ext.auth.jwt.JWTAuthOptions;
 import io.vertx.ext.web.handler.AuthenticationHandler;
 import io.vertx.ext.web.handler.JWTAuthHandler;
 import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig;
-import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationConfigEntry;
 import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationHandlerFactory;
 import org.apache.camel.main.HttpManagementServerConfigurationProperties;
 import org.apache.camel.main.HttpServerConfigurationProperties;
 
-import static org.apache.camel.util.ObjectHelper.isNotEmpty;
-
 public class JWTAuthenticationConfigurer implements MainAuthenticationConfigurer {
 
     @Override
@@ -37,34 +34,24 @@ public class JWTAuthenticationConfigurer implements MainAuthenticationConfigurer
             AuthenticationConfig authenticationConfig,
             HttpServerConfigurationProperties properties) {
 
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : null;
 
-        AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
-        entry.setPath(path);
-        entry.setAuthenticationHandlerFactory(new AuthenticationHandlerFactory() {
-            @Override
-            public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
-                    T authenticationProvider) {
-                JWTAuth authProvider = (JWTAuth) authenticationProvider;
-                return JWTAuthHandler.create(authProvider, realm);
-            }
-        });
-        entry.setAuthenticationProviderFactory(vertx -> JWTAuth.create(
-                vertx,
-                new JWTAuthOptions(
-                        new JsonObject().put("keyStore", new JsonObject()
-                                .put("type", properties.getJwtKeystoreType())
-                                .put("path", properties.getJwtKeystorePath())
-                                .put("password", properties.getJwtKeystorePassword())))));
-
-        authenticationConfig.getEntries().add(entry);
-        authenticationConfig.setEnabled(true);
+        addAuthenticationConfigEntries(authenticationConfig, properties.getAuthenticationPath(), properties.getPath(),
+                vertx -> JWTAuth.create(
+                        vertx,
+                        new JWTAuthOptions(
+                                new JsonObject().put("keyStore", new JsonObject()
+                                        .put("type", properties.getJwtKeystoreType())
+                                        .put("path", properties.getJwtKeystorePath())
+                                        .put("password", properties.getJwtKeystorePassword())))),
+                new AuthenticationHandlerFactory() {
+                    @Override
+                    public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
+                            T authenticationProvider) {
+                        JWTAuth authProvider = (JWTAuth) authenticationProvider;
+                        return JWTAuthHandler.create(authProvider, realm);
+                    }
+                });
     }
 
     @Override
@@ -72,33 +59,23 @@ public class JWTAuthenticationConfigurer implements MainAuthenticationConfigurer
             AuthenticationConfig authenticationConfig,
             HttpManagementServerConfigurationProperties properties) {
 
-        String path
-                = isNotEmpty(properties.getAuthenticationPath()) ? properties.getAuthenticationPath() : properties.getPath();
-        // root means to authenticate everything
-        if ("/".equals(path)) {
-            path = "/*";
-        }
         String realm = properties.getAuthenticationRealm() != null ? properties.getAuthenticationRealm() : null;
 
-        AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
-        entry.setPath(path);
-        entry.setAuthenticationHandlerFactory(new AuthenticationHandlerFactory() {
-            @Override
-            public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
-                    T authenticationProvider) {
-                JWTAuth authProvider = (JWTAuth) authenticationProvider;
-                return JWTAuthHandler.create(authProvider, realm);
-            }
-        });
-        entry.setAuthenticationProviderFactory(vertx -> JWTAuth.create(
-                vertx,
-                new JWTAuthOptions(
-                        new JsonObject().put("keyStore", new JsonObject()
-                                .put("type", properties.getJwtKeystoreType())
-                                .put("path", properties.getJwtKeystorePath())
-                                .put("password", properties.getJwtKeystorePassword())))));
-
-        authenticationConfig.getEntries().add(entry);
-        authenticationConfig.setEnabled(true);
+        addAuthenticationConfigEntries(authenticationConfig, properties.getAuthenticationPath(), properties.getPath(),
+                vertx -> JWTAuth.create(
+                        vertx,
+                        new JWTAuthOptions(
+                                new JsonObject().put("keyStore", new JsonObject()
+                                        .put("type", properties.getJwtKeystoreType())
+                                        .put("path", properties.getJwtKeystorePath())
+                                        .put("password", properties.getJwtKeystorePassword())))),
+                new AuthenticationHandlerFactory() {
+                    @Override
+                    public <T extends AuthenticationProvider> AuthenticationHandler createAuthenticationHandler(
+                            T authenticationProvider) {
+                        JWTAuth authProvider = (JWTAuth) authenticationProvider;
+                        return JWTAuthHandler.create(authProvider, realm);
+                    }
+                });
     }
 }
diff --git a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
index 72011adc..e0fd1e9f 100644
--- a/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
+++ b/components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/MainAuthenticationConfigurer.java
@@ -16,10 +16,18 @@
  */
 package org.apache.camel.component.platform.http.main.authentication;
 
+import java.util.LinkedHashSet;
+import java.util.Set;
+
 import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig;
+import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationConfigEntry;
+import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationHandlerFactory;
+import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationProviderFactory;
 import org.apache.camel.main.HttpManagementServerConfigurationProperties;
 import org.apache.camel.main.HttpServerConfigurationProperties;
 
+import static org.apache.camel.util.ObjectHelper.isNotEmpty;
+
 /**
  * Configure authentication on the embedded HTTP server.
  */
@@ -30,4 +38,37 @@ public interface MainAuthenticationConfigurer {
     void configureAuthentication(
             AuthenticationConfig authenticationConfig, HttpManagementServerConfigurationProperties properties);
 
+    default void addAuthenticationConfigEntries(
+            AuthenticationConfig authenticationConfig, String authenticationPath, String serverPath,
+            AuthenticationProviderFactory authenticationProviderFactory,
+            AuthenticationHandlerFactory authenticationHandlerFactory) {
+        for (String path : resolveAuthenticationPaths(authenticationPath, serverPath)) {
+            AuthenticationConfigEntry entry = new AuthenticationConfigEntry();
+            entry.setPath(path);
+            entry.setAuthenticationHandlerFactory(authenticationHandlerFactory);
+            entry.setAuthenticationProviderFactory(authenticationProviderFactory);
+            authenticationConfig.getEntries().add(entry);
+        }
+        authenticationConfig.setEnabled(true);
+    }
+
+    default Set<String> resolveAuthenticationPaths(String authenticationPath, String serverPath) {
+        String path = isNotEmpty(authenticationPath) ? authenticationPath : serverPath;
+        Set<String> paths = new LinkedHashSet<>();
+
+        if ("/".equals(path) || "/*".equals(path)) {
+            paths.add("/*");
+        } else if (path.endsWith("/*")) {
+            paths.add(path.substring(0, path.length() - 2));
+            paths.add(path);
+        } else if (path.endsWith("*")) {
+            paths.add(path);
+        } else {
+            paths.add(path);
+            paths.add(path.endsWith("/") ? path + "*" : path + "/*");
+        }
+
+        return paths;
+    }
+
 }
diff --git a/components/camel-platform-http-main/src/test/java/org/apache/camel/component/platform/http/main/authentication/AuthenticationConfigurerPathTest.java b/components/camel-platform-http-main/src/test/java/org/apache/camel/component/platform/http/main/authentication/AuthenticationConfigurerPathTest.java
new file mode 100644
index 00000000..d60da662
--- /dev/null
+++ b/components/camel-platform-http-main/src/test/java/org/apache/camel/component/platform/http/main/authentication/AuthenticationConfigurerPathTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.platform.http.main.authentication;
+
+import java.util.List;
+
+import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig;
+import org.apache.camel.component.platform.http.vertx.auth.AuthenticationConfig.AuthenticationConfigEntry;
+import org.apache.camel.main.HttpManagementServerConfigurationProperties;
+import org.apache.camel.main.HttpServerConfigurationProperties;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AuthenticationConfigurerPathTest {
+
+    @Test
+    void basicAuthenticationProtectsConfiguredServerPathAndDescendants() {
+        HttpServerConfigurationProperties properties = new HttpServerConfigurationProperties(null);
+        properties.setPath("/api");
+        properties.setBasicPropertiesFile("camel-platform-http-vertx-auth.properties");
+
+        AuthenticationConfig authenticationConfig = new AuthenticationConfig();
+        new BasicAuthenticationConfigurer().configureAuthentication(authenticationConfig, properties);
+
+        assertTrue(authenticationConfig.isEnabled());
+        assertEquals(List.of("/api", "/api/*"), paths(authenticationConfig));
+    }
+
+    @Test
+    void basicAuthenticationProtectsConfiguredManagementPathAndDescendants() {
+        HttpManagementServerConfigurationProperties properties = new HttpManagementServerConfigurationProperties(null);
+        properties.setPath("/observe");
+        properties.setBasicPropertiesFile("camel-platform-http-vertx-auth.properties");
+
+        AuthenticationConfig authenticationConfig = new AuthenticationConfig();
+        new BasicAuthenticationConfigurer().configureAuthentication(authenticationConfig, properties);
+
+        assertTrue(authenticationConfig.isEnabled());
+        assertEquals(List.of("/observe", "/observe/*"), paths(authenticationConfig));
+    }
+
+    @Test
+    void jwtAuthenticationProtectsAuthenticationPathAndDescendants() {
+        HttpServerConfigurationProperties properties = new HttpServerConfigurationProperties(null);
+        properties.setAuthenticationPath("/secure");
+        properties.setJwtKeystoreType("jks");
+        properties.setJwtKeystorePath("test-camel-main-auth-jwt.jks");
+        properties.setJwtKeystorePassword("changeme");
+
+        AuthenticationConfig authenticationConfig = new AuthenticationConfig();
+        new JWTAuthenticationConfigurer().configureAuthentication(authenticationConfig, properties);
+
+        assertTrue(authenticationConfig.isEnabled());
+        assertEquals(List.of("/secure", "/secure/*"), paths(authenticationConfig));
+    }
+
+    @Test
+    void wildcardAuthenticationPathIsPreserved() {
+        HttpServerConfigurationProperties properties = new HttpServerConfigurationProperties(null);
+        properties.setAuthenticationPath("/*");
+        properties.setBasicPropertiesFile("camel-platform-http-vertx-auth.properties");
+
+        AuthenticationConfig authenticationConfig = new AuthenticationConfig();
+        new BasicAuthenticationConfigurer().configureAuthentication(authenticationConfig, properties);
+
+        assertTrue(authenticationConfig.isEnabled());
+        assertEquals(List.of("/*"), paths(authenticationConfig));
+    }
+
+    @Test
+    void childWildcardAuthenticationPathAlsoProtectsBasePath() {
+        HttpServerConfigurationProperties properties = new HttpServerConfigurationProperties(null);
+        properties.setAuthenticationPath("/secure/*");
+        properties.setBasicPropertiesFile("camel-platform-http-vertx-auth.properties");
+
+        AuthenticationConfig authenticationConfig = new AuthenticationConfig();
+        new BasicAuthenticationConfigurer().configureAuthentication(authenticationConfig, properties);
+
+        assertTrue(authenticationConfig.isEnabled());
+        assertEquals(List.of("/secure", "/secure/*"), paths(authenticationConfig));
+    }
+
+    private static List<String> paths(AuthenticationConfig authenticationConfig) {
+        return authenticationConfig.getEntries().stream()
+                .map(AuthenticationConfigEntry::getPath)
+                .toList();
+    }
+}

diff --git a/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java b/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
index 25cd4fc1..27eb969e 100644
--- a/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
+++ b/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
@@ -22,6 +22,8 @@ import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
 import org.apache.camel.Message;
+import org.apache.camel.spi.HeaderFilterStrategy;
+import org.apache.camel.support.DefaultHeaderFilterStrategy;
 import org.eclipse.californium.core.CoapResource;
 import org.eclipse.californium.core.coap.CoAP.ResponseCode;
 import org.eclipse.californium.core.coap.MediaTypeRegistry;
@@ -36,6 +38,12 @@ final class CamelCoapResource extends CoapResource {
 
     private static final Logger LOG = LoggerFactory.getLogger(CamelCoapResource.class);
 
+    /**
+     * Filters out Camel reserved (Camel-prefixed) header names so that remote clients cannot inject or overwrite
+     * internal Camel control headers via the CoAP request (CWE-915).
+     */
+    private static final HeaderFilterStrategy HEADER_FILTER_STRATEGY = createHeaderFilterStrategy();
+
     private final Map<String, CoAPConsumer> consumers = new ConcurrentHashMap<>();
     private final List<CamelCoapResource> possibles;
 
@@ -50,6 +58,12 @@ final class CamelCoapResource extends CoapResource {
         this.possibles = possibles;
     }
 
+    private static HeaderFilterStrategy createHeaderFilterStrategy() {
+        DefaultHeaderFilterStrategy strategy = new DefaultHeaderFilterStrategy();
+        strategy.setInFilterStartsWith(DefaultHeaderFilterStrategy.CAMEL_FILTER_STARTS_WITH);
+        return strategy;
+    }
+
     void addConsumer(CoAPConsumer consumer) {
         CoAPEndpoint coapEndpoint = consumer.getCoapEndpoint();
         String coapMethodRestrict = CoAPHelper.getDefaultMethodRestrict(coapEndpoint.getCoapMethodRestrict());
@@ -102,11 +116,13 @@ final class CamelCoapResource extends CoapResource {
             OptionSet options = exchange.getRequest().getOptions();
             for (String s : options.getUriQuery()) {
                 int i = s.indexOf('=');
-                if (i == -1) {
-                    camelExchange.getIn().setHeader(s, "");
-                } else {
-                    camelExchange.getIn().setHeader(s.substring(0, i), s.substring(i + 1));
+                String name = i == -1 ? s : s.substring(0, i);
+                String value = i == -1 ? "" : s.substring(i + 1);
+                // Do not let remote clients inject/override internal Camel headers (CWE-915)
+                if (HEADER_FILTER_STRATEGY.applyFilterToExternalHeaders(name, value, camelExchange)) {
+                    continue;
                 }
+                camelExchange.getIn().setHeader(name, value);
             }
 
             if (options.hasContentFormat()) {

diff --git a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPComponentConfigurer.java b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPComponentConfigurer.java
index aa4a8a79..4ab0af19 100644
--- a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPComponentConfigurer.java
+++ b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPComponentConfigurer.java
@@ -27,7 +27,6 @@ public class CoAPComponentConfigurer extends PropertyConfigurerSupport implement
         case "autowiredEnabled": target.setAutowiredEnabled(property(camelContext, boolean.class, value)); return true;
         case "bridgeerrorhandler":
         case "bridgeErrorHandler": target.setBridgeErrorHandler(property(camelContext, boolean.class, value)); return true;
-        case "client": target.setClient(property(camelContext, org.eclipse.californium.core.CoapClient.class, value)); return true;
         case "configurationfile":
         case "configurationFile": target.setConfigurationFile(property(camelContext, java.lang.String.class, value)); return true;
         case "lazystartproducer":
@@ -43,7 +42,6 @@ public class CoAPComponentConfigurer extends PropertyConfigurerSupport implement
         case "autowiredEnabled": return boolean.class;
         case "bridgeerrorhandler":
         case "bridgeErrorHandler": return boolean.class;
-        case "client": return org.eclipse.californium.core.CoapClient.class;
         case "configurationfile":
         case "configurationFile": return java.lang.String.class;
         case "lazystartproducer":
@@ -60,7 +58,6 @@ public class CoAPComponentConfigurer extends PropertyConfigurerSupport implement
         case "autowiredEnabled": return target.isAutowiredEnabled();
         case "bridgeerrorhandler":
         case "bridgeErrorHandler": return target.isBridgeErrorHandler();
-        case "client": return target.getClient();
         case "configurationfile":
         case "configurationFile": return target.getConfigurationFile();
         case "lazystartproducer":
@@ -69,4 +66,3 @@ public class CoAPComponentConfigurer extends PropertyConfigurerSupport implement
         }
     }
 }
-
diff --git a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointConfigurer.java b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointConfigurer.java
index cce9f88d..1b00f5d2 100644
--- a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointConfigurer.java
+++ b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointConfigurer.java
@@ -32,7 +32,6 @@ public class CoAPEndpointConfigurer extends PropertyConfigurerSupport implements
         case "bridgeErrorHandler": target.setBridgeErrorHandler(property(camelContext, boolean.class, value)); return true;
         case "ciphersuites":
         case "cipherSuites": target.setCipherSuites(property(camelContext, java.lang.String.class, value)); return true;
-        case "client": target.setClient(property(camelContext, org.eclipse.californium.core.CoapClient.class, value)); return true;
         case "clientauthentication":
         case "clientAuthentication": target.setClientAuthentication(property(camelContext, org.eclipse.californium.elements.config.CertificateAuthenticationMode.class, value)); return true;
         case "coapmethodrestrict":
@@ -70,7 +69,6 @@ public class CoAPEndpointConfigurer extends PropertyConfigurerSupport implements
         case "bridgeErrorHandler": return boolean.class;
         case "ciphersuites":
         case "cipherSuites": return java.lang.String.class;
-        case "client": return org.eclipse.californium.core.CoapClient.class;
         case "clientauthentication":
         case "clientAuthentication": return org.eclipse.californium.elements.config.CertificateAuthenticationMode.class;
         case "coapmethodrestrict":
@@ -109,7 +107,6 @@ public class CoAPEndpointConfigurer extends PropertyConfigurerSupport implements
         case "bridgeErrorHandler": return target.isBridgeErrorHandler();
         case "ciphersuites":
         case "cipherSuites": return target.getCipherSuites();
-        case "client": return target.getClient();
         case "clientauthentication":
         case "clientAuthentication": return target.getClientAuthentication();
         case "coapmethodrestrict":
@@ -135,4 +132,3 @@ public class CoAPEndpointConfigurer extends PropertyConfigurerSupport implements
         }
     }
 }
-
diff --git a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointUriFactory.java b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointUriFactory.java
index 38524be0..eeffda70 100644
--- a/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointUriFactory.java
+++ b/components/camel-coap/src/generated/java/org/apache/camel/coap/CoAPEndpointUriFactory.java
@@ -24,13 +24,12 @@ public class CoAPEndpointUriFactory extends org.apache.camel.support.component.E
     private static final Set<String> SECRET_PROPERTY_NAMES;
     private static final Map<String, String> MULTI_VALUE_PREFIXES;
     static {
-        Set<String> props = new HashSet<>(19);
+        Set<String> props = new HashSet<>(18);
         props.add("advancedCertificateVerifier");
         props.add("advancedPskStore");
         props.add("alias");
         props.add("bridgeErrorHandler");
         props.add("cipherSuites");
-        props.add("client");
         props.add("clientAuthentication");
         props.add("coapMethodRestrict");
         props.add("exceptionHandler");
@@ -93,4 +92,3 @@ public class CoAPEndpointUriFactory extends org.apache.camel.support.component.E
         return false;
     }
 }
-
diff --git a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap+tcp.json b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap+tcp.json
index 162769ef..8c3e0841 100644
--- a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap+tcp.json
+++ b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap+tcp.json
@@ -28,7 +28,6 @@
     "configurationFile": { "index": 0, "kind": "property", "displayName": "Configuration File", "group": "common", "label": "", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Name of COAP configuration file to load and use. Will by default load from classpath, so use file: as prefix to load from file system." },
     "bridgeErrorHandler": { "index": 1, "kind": "property", "displayName": "Bridge Error Handler", "group": "consumer", "label": "consumer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "lazyStartProducer": { "index": 2, "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
-    "client": { "index": 3, "kind": "property", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "autowiredEnabled": { "index": 4, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." }
   },
   "headers": {
@@ -47,7 +46,6 @@
     "exceptionHandler": { "index": 5, "kind": "parameter", "displayName": "Exception Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "object", "javaType": "org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", "deprecated": false, "autowired": false, "secret": false, "description": "To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exchangePattern": { "index": 6, "kind": "parameter", "displayName": "Exchange Pattern", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "enum", "javaType": "org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], "deprecated": false, "autowired": false, "secret": false, "description": "Sets the exchange pattern when the consumer creates an exchange." },
     "notify": { "index": 7, "kind": "parameter", "displayName": "Notify", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Notify observers that the resource of this URI has changed, based on RFC 7641. Use this flag on a destination endpoint, with a URI that matches an existing source endpoint URI." },
-    "client": { "index": 8, "kind": "parameter", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "lazyStartProducer": { "index": 9, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
     "advancedCertificateVerifier": { "index": 10, "kind": "parameter", "displayName": "Advanced Certificate Verifier", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.x509.NewAdvancedCertificateVerifier", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedCertificateVerifier to use to determine trust in raw public keys." },
     "advancedPskStore": { "index": 11, "kind": "parameter", "displayName": "Advanced Psk Store", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.pskstore.AdvancedPskStore", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedPskStore to use for pre-shared key." },
diff --git a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap.json b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap.json
index 6506e161..57e569bb 100644
--- a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap.json
+++ b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coap.json
@@ -28,7 +28,6 @@
     "configurationFile": { "index": 0, "kind": "property", "displayName": "Configuration File", "group": "common", "label": "", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Name of COAP configuration file to load and use. Will by default load from classpath, so use file: as prefix to load from file system." },
     "bridgeErrorHandler": { "index": 1, "kind": "property", "displayName": "Bridge Error Handler", "group": "consumer", "label": "consumer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "lazyStartProducer": { "index": 2, "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
-    "client": { "index": 3, "kind": "property", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "autowiredEnabled": { "index": 4, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." }
   },
   "headers": {
@@ -47,7 +46,6 @@
     "exceptionHandler": { "index": 5, "kind": "parameter", "displayName": "Exception Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "object", "javaType": "org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", "deprecated": false, "autowired": false, "secret": false, "description": "To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exchangePattern": { "index": 6, "kind": "parameter", "displayName": "Exchange Pattern", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "enum", "javaType": "org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], "deprecated": false, "autowired": false, "secret": false, "description": "Sets the exchange pattern when the consumer creates an exchange." },
     "notify": { "index": 7, "kind": "parameter", "displayName": "Notify", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Notify observers that the resource of this URI has changed, based on RFC 7641. Use this flag on a destination endpoint, with a URI that matches an existing source endpoint URI." },
-    "client": { "index": 8, "kind": "parameter", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "lazyStartProducer": { "index": 9, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
     "advancedCertificateVerifier": { "index": 10, "kind": "parameter", "displayName": "Advanced Certificate Verifier", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.x509.NewAdvancedCertificateVerifier", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedCertificateVerifier to use to determine trust in raw public keys." },
     "advancedPskStore": { "index": 11, "kind": "parameter", "displayName": "Advanced Psk Store", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.pskstore.AdvancedPskStore", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedPskStore to use for pre-shared key." },
diff --git a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps+tcp.json b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps+tcp.json
index bfbc4b50..92293c5c 100644
--- a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps+tcp.json
+++ b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps+tcp.json
@@ -28,7 +28,6 @@
     "configurationFile": { "index": 0, "kind": "property", "displayName": "Configuration File", "group": "common", "label": "", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Name of COAP configuration file to load and use. Will by default load from classpath, so use file: as prefix to load from file system." },
     "bridgeErrorHandler": { "index": 1, "kind": "property", "displayName": "Bridge Error Handler", "group": "consumer", "label": "consumer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "lazyStartProducer": { "index": 2, "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
-    "client": { "index": 3, "kind": "property", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "autowiredEnabled": { "index": 4, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." }
   },
   "headers": {
@@ -47,7 +46,6 @@
     "exceptionHandler": { "index": 5, "kind": "parameter", "displayName": "Exception Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "object", "javaType": "org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", "deprecated": false, "autowired": false, "secret": false, "description": "To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exchangePattern": { "index": 6, "kind": "parameter", "displayName": "Exchange Pattern", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "enum", "javaType": "org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], "deprecated": false, "autowired": false, "secret": false, "description": "Sets the exchange pattern when the consumer creates an exchange." },
     "notify": { "index": 7, "kind": "parameter", "displayName": "Notify", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Notify observers that the resource of this URI has changed, based on RFC 7641. Use this flag on a destination endpoint, with a URI that matches an existing source endpoint URI." },
-    "client": { "index": 8, "kind": "parameter", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "lazyStartProducer": { "index": 9, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
     "advancedCertificateVerifier": { "index": 10, "kind": "parameter", "displayName": "Advanced Certificate Verifier", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.x509.NewAdvancedCertificateVerifier", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedCertificateVerifier to use to determine trust in raw public keys." },
     "advancedPskStore": { "index": 11, "kind": "parameter", "displayName": "Advanced Psk Store", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.pskstore.AdvancedPskStore", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedPskStore to use for pre-shared key." },
diff --git a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps.json b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps.json
index fef25a48..72ac0aca 100644
--- a/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps.json
+++ b/components/camel-coap/src/generated/resources/META-INF/org/apache/camel/coap/coaps.json
@@ -28,7 +28,6 @@
     "configurationFile": { "index": 0, "kind": "property", "displayName": "Configuration File", "group": "common", "label": "", "required": false, "type": "string", "javaType": "java.lang.String", "deprecated": false, "autowired": false, "secret": false, "description": "Name of COAP configuration file to load and use. Will by default load from classpath, so use file: as prefix to load from file system." },
     "bridgeErrorHandler": { "index": 1, "kind": "property", "displayName": "Bridge Error Handler", "group": "consumer", "label": "consumer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Allows for bridging the consumer to the Camel routing Error Handler, which mean any exceptions (if possible) occurred while the Camel consumer is trying to pickup incoming messages, or the likes, will now be processed as a message and handled by the routing Error Handler. Important: This is only possible if the 3rd party component allows Camel to be alerted if an exception was thrown. Some components handle this internally only, and therefore bridgeErrorHandler is not possible. In other situations we may improve the Camel component to hook into the 3rd party component and make this possible for future releases. By default the consumer will use the org.apache.camel.spi.ExceptionHandler to deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "lazyStartProducer": { "index": 2, "kind": "property", "displayName": "Lazy Start Producer", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
-    "client": { "index": 3, "kind": "property", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "autowiredEnabled": { "index": 4, "kind": "property", "displayName": "Autowired Enabled", "group": "advanced", "label": "advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": true, "description": "Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc." }
   },
   "headers": {
@@ -47,7 +46,6 @@
     "exceptionHandler": { "index": 5, "kind": "parameter", "displayName": "Exception Handler", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "object", "javaType": "org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", "deprecated": false, "autowired": false, "secret": false, "description": "To let the consumer use a custom ExceptionHandler. Notice if the option bridgeErrorHandler is enabled then this option is not in use. By default the consumer will deal with exceptions, that will be logged at WARN or ERROR level and ignored." },
     "exchangePattern": { "index": 6, "kind": "parameter", "displayName": "Exchange Pattern", "group": "consumer (advanced)", "label": "consumer,advanced", "required": false, "type": "enum", "javaType": "org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], "deprecated": false, "autowired": false, "secret": false, "description": "Sets the exchange pattern when the consumer creates an exchange." },
     "notify": { "index": 7, "kind": "parameter", "displayName": "Notify", "group": "producer", "label": "producer", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Notify observers that the resource of this URI has changed, based on RFC 7641. Use this flag on a destination endpoint, with a URI that matches an existing source endpoint URI." },
-    "client": { "index": 8, "kind": "parameter", "displayName": "Client", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "object", "javaType": "org.eclipse.californium.core.CoapClient", "deprecated": false, "autowired": false, "secret": false, "description": "To use a shared client for the producers" },
     "lazyStartProducer": { "index": 9, "kind": "parameter", "displayName": "Lazy Start Producer", "group": "producer (advanced)", "label": "producer,advanced", "required": false, "type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": false, "secret": false, "defaultValue": false, "description": "Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel's routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing." },
     "advancedCertificateVerifier": { "index": 10, "kind": "parameter", "displayName": "Advanced Certificate Verifier", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.x509.NewAdvancedCertificateVerifier", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedCertificateVerifier to use to determine trust in raw public keys." },
     "advancedPskStore": { "index": 11, "kind": "parameter", "displayName": "Advanced Psk Store", "group": "security", "label": "security", "required": false, "type": "object", "javaType": "org.eclipse.californium.scandium.dtls.pskstore.AdvancedPskStore", "deprecated": false, "autowired": false, "secret": false, "description": "Set the AdvancedPskStore to use for pre-shared key." },
diff --git a/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java b/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
index 25cd4fc1..f73de4d3 100644
--- a/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
+++ b/components/camel-coap/src/main/java/org/apache/camel/coap/CamelCoapResource.java
@@ -103,9 +103,9 @@ final class CamelCoapResource extends CoapResource {
             for (String s : options.getUriQuery()) {
                 int i = s.indexOf('=');
                 if (i == -1) {
-                    camelExchange.getIn().setHeader(s, "");
+                    setQueryHeader(camelExchange, s, "");
                 } else {
-                    camelExchange.getIn().setHeader(s.substring(0, i), s.substring(i + 1));
+                    setQueryHeader(camelExchange, s.substring(0, i), s.substring(i + 1));
                 }
             }
 
@@ -135,7 +135,7 @@ final class CamelCoapResource extends CoapResource {
             }
 
             byte[] bytes = exchange.getRequest().getPayload();
-            camelExchange.getIn().setBody(bytes);
+            camelExchange.getIn().setBody(bytes.clone());
 
             consumer.getProcessor().process(camelExchange);
             Message target = camelExchange.getMessage();
@@ -147,7 +147,7 @@ final class CamelCoapResource extends CoapResource {
 
             byte[] eTag = target.getHeader(CoAPConstants.COAP_ETAG, byte[].class);
             if (eTag != null) {
-                cexchange.setETag(eTag);
+                cexchange.setETag(eTag.clone());
             }
 
             int format = MediaTypeRegistry.parse(target.getHeader(CoAPConstants.CONTENT_TYPE, String.class));
@@ -167,4 +167,16 @@ final class CamelCoapResource extends CoapResource {
             }
         }
     }
+
+    private static void setQueryHeader(org.apache.camel.Exchange exchange, String name, String value) {
+        if (!isFilteredQueryHeader(name)) {
+            exchange.getIn().setHeader(name, value);
+        }
+    }
+
+    private static boolean isFilteredQueryHeader(String name) {
+        return name.startsWith("Camel")
+                || name.startsWith("camel")
+                || CoAPConstants.CONTENT_TYPE.equalsIgnoreCase(name);
+    }
 }
diff --git a/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPComponent.java b/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPComponent.java
index 4b0b19cd..a747bee6 100644
--- a/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPComponent.java
+++ b/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPComponent.java
@@ -65,7 +65,6 @@ public class CoAPComponent extends DefaultComponent implements RestConsumerFacto
 
     @Metadata
     private String configurationFile;
-    @Metadata(label = "producer,advanced")
     private CoapClient client;
 
     final Map<Integer, CoapServer> servers = new ConcurrentHashMap<>();
diff --git a/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPEndpoint.java b/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPEndpoint.java
index 40b694b0..54dd967d 100644
--- a/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPEndpoint.java
+++ b/components/camel-coap/src/main/java/org/apache/camel/coap/CoAPEndpoint.java
@@ -107,7 +107,6 @@ public class CoAPEndpoint extends DefaultEndpoint implements EndpointServiceLoca
     private boolean observable;
     @UriParam(label = "producer", defaultValue = "false")
     private boolean notify;
-    @UriParam(label = "producer,advanced")
     private CoapClient client;
 
     private CoAPComponent component;
diff --git a/components/camel-coap/src/test/java/org/apache/camel/coap/CoAPComponentTest.java b/components/camel-coap/src/test/java/org/apache/camel/coap/CoAPComponentTest.java
index 454b11bd..b311c9c0 100644
--- a/components/camel-coap/src/test/java/org/apache/camel/coap/CoAPComponentTest.java
+++ b/components/camel-coap/src/test/java/org/apache/camel/coap/CoAPComponentTest.java
@@ -69,6 +69,20 @@ public class CoAPComponentTest extends CoAPTestSupport {
         MockEndpoint.assertIsSatisfied(context);
     }
 
+    @Test
+    void testCoAPQueryDoesNotSetInternalHeaders() throws Exception {
+        MockEndpoint mock = getMockEndpoint("mock:queryHeaders");
+        mock.expectedMessageCount(1);
+        mock.expectedHeaderReceived("id", "Ducky");
+        mock.message(0).header(CoAPConstants.COAP_MAX_AGE).isNull();
+
+        CoapClient client = createClient("/QueryHeaders?id=Ducky&CamelCoapMaxAge=10");
+        CoapResponse response = client.get();
+
+        assertEquals("ok", response.getResponseText());
+        MockEndpoint.assertIsSatisfied(context);
+    }
+
     @Override
     protected RouteBuilder createRouteBuilder() {
         return new RouteBuilder() {
@@ -80,6 +94,8 @@ public class CoAPComponentTest extends CoAPTestSupport {
                 fromF("coap+tcp://localhost:%d/TestResource", TCP_PORT.getPort()).convertBodyTo(String.class)
                         .transform(body().prepend("Hello "));
 
+                fromF("coap://localhost:%d/QueryHeaders", PORT.getPort()).to("mock:queryHeaders").setBody(constant("ok"));
+
                 from("direct:start").toF("coap://localhost:%d/TestResource", PORT.getPort()).to("mock:result");
 
                 from("direct:starttcp").toF("coap+tcp://localhost:%d/TestResource", TCP_PORT.getPort()).to("mock:result");

diff --git a/router/artifact_router.go b/router/artifact_router.go
index 7d48b2d..46e256e 100644
--- a/router/artifact_router.go
+++ b/router/artifact_router.go
@@ -30,7 +30,10 @@ func NewArtifactRouter(
 	assetVersionGroup AssetVersionRouter,
 	artifactController *controllers.ArtifactController,
 	artifactRepository shared.ArtifactRepository,
+	assetRepository shared.AssetRepository,
 ) ArtifactRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	artifactRouter := assetVersionGroup.Group.Group("/artifacts/:artifactName", middlewares.ArtifactMiddleware(artifactRepository))
 
 	artifactRouter.GET("/sbom.json/", artifactController.SBOMJSON)
@@ -41,8 +44,8 @@ func NewArtifactRouter(
 	artifactRouter.GET("/sbom.pdf/", artifactController.BuildPDFFromSBOM)
 	artifactRouter.GET("/vulnerability-report.pdf/", artifactController.BuildVulnerabilityReportPDF)
 
-	artifactRouter.DELETE("/", artifactController.DeleteArtifact, middlewares.NeededScope([]string{"manage"}))
-	artifactRouter.PUT("/", artifactController.UpdateArtifact, middlewares.NeededScope([]string{"manage"}))
+	artifactRouter.DELETE("/", artifactController.DeleteArtifact, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	artifactRouter.PUT("/", artifactController.UpdateArtifact, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return ArtifactRouter{Group: artifactRouter}
 }
diff --git a/router/asset_version_router.go b/router/asset_version_router.go
index 06a6f1d..1ded325 100644
--- a/router/asset_version_router.go
+++ b/router/asset_version_router.go
@@ -67,9 +67,9 @@ func NewAssetVersionRouter(
 	assetVersionRouter.GET("/artifacts/", assetVersionController.ListArtifacts)
 	assetVersionRouter.GET("/artifact-root-nodes/", assetVersionController.ReadRootNodes)
 
-	assetVersionRouter.POST("/artifacts/", artifactController.Create, middlewares.NeededScope([]string{"manage"}))
+	assetVersionRouter.POST("/artifacts/", artifactController.Create, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
-	assetVersionRouter.POST("/components/licenses/refresh/", assetVersionController.RefetchLicenses, middlewares.NeededScope([]string{"manage"}))
+	assetVersionRouter.POST("/components/licenses/refresh/", assetVersionController.RefetchLicenses, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.DELETE("/", assetVersionController.Delete, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.POST("/make-default/", assetVersionController.MakeDefault, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.DELETE("/events/:eventID/", vulnEventController.DeleteEventByID, middlewares.EventMiddleware(vulnEventRepository), middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
diff --git a/router/dependency_vuln_router.go b/router/dependency_vuln_router.go
index 5ee89cf..5f123a9 100644
--- a/router/dependency_vuln_router.go
+++ b/router/dependency_vuln_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -29,17 +30,20 @@ func NewDependencyVulnRouter(
 	assetVersionGroup AssetVersionRouter,
 	dependencyVulnController *controllers.DependencyVulnController,
 	vulnEventController *controllers.VulnEventController,
+	assetRepository shared.AssetRepository,
 ) DependencyVulnRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	dependencyVulnRouter := assetVersionGroup.Group.Group("/dependency-vulns")
 	dependencyVulnRouter.GET("/", dependencyVulnController.ListPaged)
 	dependencyVulnRouter.GET("/:dependencyVulnID/", dependencyVulnController.Read)
 	dependencyVulnRouter.GET("/:dependencyVulnID/events/", vulnEventController.ReadAssetEventsByVulnID)
 	dependencyVulnRouter.GET("/:dependencyVulnID/hints/", dependencyVulnController.Hints)
 
-	dependencyVulnRouter.POST("/sync/", dependencyVulnController.SyncDependencyVulns, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/batch/", dependencyVulnController.BatchCreateEvent, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/:dependencyVulnID/", dependencyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/:dependencyVulnID/mitigate/", dependencyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}))
+	dependencyVulnRouter.POST("/sync/", dependencyVulnController.SyncDependencyVulns, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/batch/", dependencyVulnController.BatchCreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/:dependencyVulnID/", dependencyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/:dependencyVulnID/mitigate/", dependencyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return DependencyVulnRouter{Group: dependencyVulnRouter}
 }
diff --git a/router/external_reference_router.go b/router/external_reference_router.go
index bc2e1bd..667c483 100644
--- a/router/external_reference_router.go
+++ b/router/external_reference_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,14 +29,17 @@ type ExternalReferenceRouter struct {
 func NewExternalReferenceRouter(
 	assetVersionRouter AssetVersionRouter,
 	externalReferenceController *controllers.ExternalReferenceController,
+	assetRepository shared.AssetRepository,
 ) ExternalReferenceRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	// External references are scoped to asset versions
 	// Read access - anyone who can read the asset version can list references
 	refGroup := assetVersionRouter.Group.Group("/external-references")
 	refGroup.GET("/", externalReferenceController.List) // List all references for asset version
 
 	// Write access - requires asset update permission
-	refWriteGroup := refGroup.Group("", middlewares.NeededScope([]string{"manage"}))
+	refWriteGroup := refGroup.Group("", middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	refWriteGroup.POST("/", externalReferenceController.Create)       // Create reference
 	refWriteGroup.POST("/sync/", externalReferenceController.Sync)    // Sync external sources
 	refWriteGroup.DELETE("/:id/", externalReferenceController.Delete) // Delete reference
diff --git a/router/first_party_vuln_router.go b/router/first_party_vuln_router.go
index 755cd86..63033f5 100644
--- a/router/first_party_vuln_router.go
+++ b/router/first_party_vuln_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -29,14 +30,17 @@ func NewFirstPartyVulnRouter(
 	assetVersionGroup AssetVersionRouter,
 	firstPartyVulnController *controllers.FirstPartyVulnController,
 	vulnEventController *controllers.VulnEventController,
+	assetRepository shared.AssetRepository,
 ) FirstPartyVulnRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	firstPartyVulnRouter := assetVersionGroup.Group.Group("/first-party-vulns")
 	firstPartyVulnRouter.GET("/", firstPartyVulnController.ListPaged)
 	firstPartyVulnRouter.GET("/:firstPartyVulnID/", firstPartyVulnController.Read)
 	firstPartyVulnRouter.GET("/:firstPartyVulnID/events/", vulnEventController.ReadAssetEventsByVulnID)
 
-	firstPartyVulnRouter.POST("/:firstPartyVulnID/", firstPartyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	firstPartyVulnRouter.POST("/:firstPartyVulnID/mitigate/", firstPartyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}))
+	firstPartyVulnRouter.POST("/:firstPartyVulnID/", firstPartyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	firstPartyVulnRouter.POST("/:firstPartyVulnID/mitigate/", firstPartyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return FirstPartyVulnRouter{Group: firstPartyVulnRouter}
 }
diff --git a/router/license_risk_router.go b/router/license_risk_router.go
index f9ab91e..75134bf 100644
--- a/router/license_risk_router.go
+++ b/router/license_risk_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,14 +29,17 @@ type LicenseRiskRouter struct {
 func NewLicenseRiskRouter(
 	assetVersionGroup AssetVersionRouter,
 	licenseRiskController *controllers.LicenseRiskController,
+	assetRepository shared.AssetRepository,
 ) LicenseRiskRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	licenseRiskRouter := assetVersionGroup.Group.Group("/license-risks")
 	licenseRiskRouter.GET("/", licenseRiskController.ListPaged)
 	licenseRiskRouter.GET("/:licenseRiskID/", licenseRiskController.Read)
-	licenseRiskRouter.POST("/", licenseRiskController.Create, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/", licenseRiskController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/mitigate/", licenseRiskController.Mitigate, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/final-license-decision/", licenseRiskController.MakeFinalLicenseDecision, middlewares.NeededScope([]string{"manage"}))
+	licenseRiskRouter.POST("/", licenseRiskController.Create, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/", licenseRiskController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/mitigate/", licenseRiskController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/final-license-decision/", licenseRiskController.MakeFinalLicenseDecision, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return LicenseRiskRouter{Group: licenseRiskRouter}
 }
diff --git a/router/vex_rule_router.go b/router/vex_rule_router.go
index 067e1fb..30261e7 100644
--- a/router/vex_rule_router.go
+++ b/router/vex_rule_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,7 +29,10 @@ type VEXRuleRouter struct {
 func NewVEXRuleRouter(
 	assetVersionRouter AssetVersionRouter,
 	vexRuleController *controllers.VEXRuleController,
+	assetRepository shared.AssetRepository,
 ) VEXRuleRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
+
 	// VEX rules are scoped to asset versions
 	// Read access - anyone who can read the asset version can list and get rules
 	ruleGroup := assetVersionRouter.Group.Group("/vex-rules")
@@ -36,7 +40,7 @@ func NewVEXRuleRouter(
 	ruleGroup.GET("/:ruleId/", vexRuleController.Get) // Get single rule by ID
 
 	// Write access - requires asset update permission
-	ruleWriteGroup := ruleGroup.Group("", middlewares.NeededScope([]string{"manage"}))
+	ruleWriteGroup := ruleGroup.Group("", middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	ruleWriteGroup.POST("/", vexRuleController.Create)                  // Create rule
 	ruleWriteGroup.PUT("/:ruleId/", vexRuleController.Update)           // Update rule by ID
 	ruleWriteGroup.POST("/:ruleId/reapply/", vexRuleController.Reapply) // Reapply rule to existing vulns

diff --git a/router/artifact_router.go b/router/artifact_router.go
index 7d48b2d..9b5ee19 100644
--- a/router/artifact_router.go
+++ b/router/artifact_router.go
@@ -30,8 +30,10 @@ func NewArtifactRouter(
 	assetVersionGroup AssetVersionRouter,
 	artifactController *controllers.ArtifactController,
 	artifactRepository shared.ArtifactRepository,
+	assetRepository shared.AssetRepository,
 ) ArtifactRouter {
 	artifactRouter := assetVersionGroup.Group.Group("/artifacts/:artifactName", middlewares.ArtifactMiddleware(artifactRepository))
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 
 	artifactRouter.GET("/sbom.json/", artifactController.SBOMJSON)
 	artifactRouter.GET("/sbom.xml/", artifactController.SBOMXML)
@@ -41,8 +43,8 @@ func NewArtifactRouter(
 	artifactRouter.GET("/sbom.pdf/", artifactController.BuildPDFFromSBOM)
 	artifactRouter.GET("/vulnerability-report.pdf/", artifactController.BuildVulnerabilityReportPDF)
 
-	artifactRouter.DELETE("/", artifactController.DeleteArtifact, middlewares.NeededScope([]string{"manage"}))
-	artifactRouter.PUT("/", artifactController.UpdateArtifact, middlewares.NeededScope([]string{"manage"}))
+	artifactRouter.DELETE("/", artifactController.DeleteArtifact, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	artifactRouter.PUT("/", artifactController.UpdateArtifact, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return ArtifactRouter{Group: artifactRouter}
 }
diff --git a/router/asset_version_router.go b/router/asset_version_router.go
index 06a6f1d..1ded325 100644
--- a/router/asset_version_router.go
+++ b/router/asset_version_router.go
@@ -67,9 +67,9 @@ func NewAssetVersionRouter(
 	assetVersionRouter.GET("/artifacts/", assetVersionController.ListArtifacts)
 	assetVersionRouter.GET("/artifact-root-nodes/", assetVersionController.ReadRootNodes)
 
-	assetVersionRouter.POST("/artifacts/", artifactController.Create, middlewares.NeededScope([]string{"manage"}))
+	assetVersionRouter.POST("/artifacts/", artifactController.Create, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
-	assetVersionRouter.POST("/components/licenses/refresh/", assetVersionController.RefetchLicenses, middlewares.NeededScope([]string{"manage"}))
+	assetVersionRouter.POST("/components/licenses/refresh/", assetVersionController.RefetchLicenses, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.DELETE("/", assetVersionController.Delete, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.POST("/make-default/", assetVersionController.MakeDefault, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	assetVersionRouter.DELETE("/events/:eventID/", vulnEventController.DeleteEventByID, middlewares.EventMiddleware(vulnEventRepository), middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
diff --git a/router/dependency_vuln_router.go b/router/dependency_vuln_router.go
index 5ee89cf..8c42f0b 100644
--- a/router/dependency_vuln_router.go
+++ b/router/dependency_vuln_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -29,17 +30,19 @@ func NewDependencyVulnRouter(
 	assetVersionGroup AssetVersionRouter,
 	dependencyVulnController *controllers.DependencyVulnController,
 	vulnEventController *controllers.VulnEventController,
+	assetRepository shared.AssetRepository,
 ) DependencyVulnRouter {
 	dependencyVulnRouter := assetVersionGroup.Group.Group("/dependency-vulns")
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 	dependencyVulnRouter.GET("/", dependencyVulnController.ListPaged)
 	dependencyVulnRouter.GET("/:dependencyVulnID/", dependencyVulnController.Read)
 	dependencyVulnRouter.GET("/:dependencyVulnID/events/", vulnEventController.ReadAssetEventsByVulnID)
 	dependencyVulnRouter.GET("/:dependencyVulnID/hints/", dependencyVulnController.Hints)
 
-	dependencyVulnRouter.POST("/sync/", dependencyVulnController.SyncDependencyVulns, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/batch/", dependencyVulnController.BatchCreateEvent, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/:dependencyVulnID/", dependencyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	dependencyVulnRouter.POST("/:dependencyVulnID/mitigate/", dependencyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}))
+	dependencyVulnRouter.POST("/sync/", dependencyVulnController.SyncDependencyVulns, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/batch/", dependencyVulnController.BatchCreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/:dependencyVulnID/", dependencyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	dependencyVulnRouter.POST("/:dependencyVulnID/mitigate/", dependencyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return DependencyVulnRouter{Group: dependencyVulnRouter}
 }
diff --git a/router/external_reference_router.go b/router/external_reference_router.go
index bc2e1bd..c0d9d3d 100644
--- a/router/external_reference_router.go
+++ b/router/external_reference_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,14 +29,16 @@ type ExternalReferenceRouter struct {
 func NewExternalReferenceRouter(
 	assetVersionRouter AssetVersionRouter,
 	externalReferenceController *controllers.ExternalReferenceController,
+	assetRepository shared.AssetRepository,
 ) ExternalReferenceRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 	// External references are scoped to asset versions
 	// Read access - anyone who can read the asset version can list references
 	refGroup := assetVersionRouter.Group.Group("/external-references")
 	refGroup.GET("/", externalReferenceController.List) // List all references for asset version
 
 	// Write access - requires asset update permission
-	refWriteGroup := refGroup.Group("", middlewares.NeededScope([]string{"manage"}))
+	refWriteGroup := refGroup.Group("", middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	refWriteGroup.POST("/", externalReferenceController.Create)       // Create reference
 	refWriteGroup.POST("/sync/", externalReferenceController.Sync)    // Sync external sources
 	refWriteGroup.DELETE("/:id/", externalReferenceController.Delete) // Delete reference
diff --git a/router/first_party_vuln_router.go b/router/first_party_vuln_router.go
index 755cd86..88d83f6 100644
--- a/router/first_party_vuln_router.go
+++ b/router/first_party_vuln_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -29,14 +30,16 @@ func NewFirstPartyVulnRouter(
 	assetVersionGroup AssetVersionRouter,
 	firstPartyVulnController *controllers.FirstPartyVulnController,
 	vulnEventController *controllers.VulnEventController,
+	assetRepository shared.AssetRepository,
 ) FirstPartyVulnRouter {
 	firstPartyVulnRouter := assetVersionGroup.Group.Group("/first-party-vulns")
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 	firstPartyVulnRouter.GET("/", firstPartyVulnController.ListPaged)
 	firstPartyVulnRouter.GET("/:firstPartyVulnID/", firstPartyVulnController.Read)
 	firstPartyVulnRouter.GET("/:firstPartyVulnID/events/", vulnEventController.ReadAssetEventsByVulnID)
 
-	firstPartyVulnRouter.POST("/:firstPartyVulnID/", firstPartyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	firstPartyVulnRouter.POST("/:firstPartyVulnID/mitigate/", firstPartyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}))
+	firstPartyVulnRouter.POST("/:firstPartyVulnID/", firstPartyVulnController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	firstPartyVulnRouter.POST("/:firstPartyVulnID/mitigate/", firstPartyVulnController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return FirstPartyVulnRouter{Group: firstPartyVulnRouter}
 }
diff --git a/router/license_risk_router.go b/router/license_risk_router.go
index f9ab91e..4230589 100644
--- a/router/license_risk_router.go
+++ b/router/license_risk_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,14 +29,16 @@ type LicenseRiskRouter struct {
 func NewLicenseRiskRouter(
 	assetVersionGroup AssetVersionRouter,
 	licenseRiskController *controllers.LicenseRiskController,
+	assetRepository shared.AssetRepository,
 ) LicenseRiskRouter {
 	licenseRiskRouter := assetVersionGroup.Group.Group("/license-risks")
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 	licenseRiskRouter.GET("/", licenseRiskController.ListPaged)
 	licenseRiskRouter.GET("/:licenseRiskID/", licenseRiskController.Read)
-	licenseRiskRouter.POST("/", licenseRiskController.Create, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/", licenseRiskController.CreateEvent, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/mitigate/", licenseRiskController.Mitigate, middlewares.NeededScope([]string{"manage"}))
-	licenseRiskRouter.POST("/:licenseRiskID/final-license-decision/", licenseRiskController.MakeFinalLicenseDecision, middlewares.NeededScope([]string{"manage"}))
+	licenseRiskRouter.POST("/", licenseRiskController.Create, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/", licenseRiskController.CreateEvent, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/mitigate/", licenseRiskController.Mitigate, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
+	licenseRiskRouter.POST("/:licenseRiskID/final-license-decision/", licenseRiskController.MakeFinalLicenseDecision, middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 
 	return LicenseRiskRouter{Group: licenseRiskRouter}
 }
diff --git a/router/vex_rule_router.go b/router/vex_rule_router.go
index 067e1fb..d2f077b 100644
--- a/router/vex_rule_router.go
+++ b/router/vex_rule_router.go
@@ -18,6 +18,7 @@ package router
 import (
 	"github.com/l3montree-dev/devguard/controllers"
 	"github.com/l3montree-dev/devguard/middlewares"
+	"github.com/l3montree-dev/devguard/shared"
 	"github.com/labstack/echo/v4"
 )
 
@@ -28,7 +29,9 @@ type VEXRuleRouter struct {
 func NewVEXRuleRouter(
 	assetVersionRouter AssetVersionRouter,
 	vexRuleController *controllers.VEXRuleController,
+	assetRepository shared.AssetRepository,
 ) VEXRuleRouter {
+	assetScopedRBAC := middlewares.AssetAccessControlFactory(assetRepository)
 	// VEX rules are scoped to asset versions
 	// Read access - anyone who can read the asset version can list and get rules
 	ruleGroup := assetVersionRouter.Group.Group("/vex-rules")
@@ -36,7 +39,7 @@ func NewVEXRuleRouter(
 	ruleGroup.GET("/:ruleId/", vexRuleController.Get) // Get single rule by ID
 
 	// Write access - requires asset update permission
-	ruleWriteGroup := ruleGroup.Group("", middlewares.NeededScope([]string{"manage"}))
+	ruleWriteGroup := ruleGroup.Group("", middlewares.NeededScope([]string{"manage"}), assetScopedRBAC(shared.ObjectAsset, shared.ActionUpdate))
 	ruleWriteGroup.POST("/", vexRuleController.Create)                  // Create rule
 	ruleWriteGroup.PUT("/:ruleId/", vexRuleController.Update)           // Update rule by ID
 	ruleWriteGroup.POST("/:ruleId/reapply/", vexRuleController.Reapply) // Reapply rule to existing vulns

diff --git a/connector/authproxy/authproxy.go b/connector/authproxy/authproxy.go
index f3d87fc..fd9252a 100644
--- a/connector/authproxy/authproxy.go
+++ b/connector/authproxy/authproxy.go
@@ -19,6 +19,7 @@ import (
 // Headers retrieved to fetch user's email and group can be configured
 // with userHeader and groupHeader.
 type Config struct {
+	RedirectURI          string   `json:"redirectURI"`
 	UserIDHeader         string   `json:"userIDHeader"`
 	UserHeader           string   `json:"userHeader"`
 	UserNameHeader       string   `json:"userNameHeader"`
@@ -56,6 +57,7 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 	}
 
 	return &callback{
+		redirectURI:          c.RedirectURI,
 		userIDHeader:         userIDHeader,
 		userHeader:           userHeader,
 		userNameHeader:       userNameHeader,
@@ -71,6 +73,7 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 // Callback is a connector which returns an identity with the HTTP header
 // X-Remote-User as verified email.
 type callback struct {
+	redirectURI          string
 	userIDHeader         string
 	userNameHeader       string
 	userHeader           string
@@ -84,6 +87,9 @@ type callback struct {
 
 // LoginURL returns the URL to redirect the user to login with.
 func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+	if m.redirectURI != callbackURL {
+		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, m.redirectURI)
+	}
 	u, err := url.Parse(callbackURL)
 	if err != nil {
 		return "", fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)

diff --git a/connector/authproxy/authproxy.go b/connector/authproxy/authproxy.go
index f3d87fc..18f4c1b 100644
--- a/connector/authproxy/authproxy.go
+++ b/connector/authproxy/authproxy.go
@@ -65,6 +65,7 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 		groups:               c.Groups,
 		logger:               logger.With(slog.Group("connector", "type", "authproxy", "id", id)),
 		pathSuffix:           "/" + id,
+		rawPathSuffix:        "/" + url.PathEscape(id),
 	}, nil
 }
 
@@ -80,23 +81,28 @@ type callback struct {
 	groups               []string
 	logger               *slog.Logger
 	pathSuffix           string
+	rawPathSuffix        string
 }
 
+var _ connector.CallbackConnector = (*callback)(nil)
+
 // LoginURL returns the URL to redirect the user to login with.
-func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) {
+func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
 	u, err := url.Parse(callbackURL)
 	if err != nil {
-		return "", fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
+		return "", nil, fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
 	}
+	escapedPath := u.EscapedPath()
 	u.Path += m.pathSuffix
+	u.RawPath = escapedPath + m.rawPathSuffix
 	v := u.Query()
 	v.Set("state", state)
 	u.RawQuery = v.Encode()
-	return u.String(), nil
+	return u.String(), nil, nil
 }
 
 // HandleCallback parses the request and returns the user's identity
-func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) {
+func (m *callback) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (connector.Identity, error) {
 	remoteUser := r.Header.Get(m.userHeader)
 	if remoteUser == "" {
 		return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader)
diff --git a/connector/authproxy/authproxy_test.go b/connector/authproxy/authproxy_test.go
index fbdd2a5..b9b8d00 100644
--- a/connector/authproxy/authproxy_test.go
+++ b/connector/authproxy/authproxy_test.go
@@ -3,6 +3,7 @@ package authproxy
 import (
 	"log/slog"
 	"net/http"
+	"net/url"
 	"reflect"
 	"testing"
 
@@ -36,7 +37,7 @@ func TestUser(t *testing.T) {
 		"X-Remote-User": {testUsername},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	// If not specified, the userID and email should fall back to the remote user
@@ -47,6 +48,22 @@ func TestUser(t *testing.T) {
 	expectEquals(t, len(ident.Groups), 0)
 }
 
+func TestLoginURL(t *testing.T) {
+	config := Config{}
+
+	conn, _ := config.Open("test/connector", logger)
+	callback := conn.(*callback)
+
+	loginURL, connData, err := callback.LoginURL(connector.Scopes{}, "https://example.com/callback", "some-state")
+	expectNil(t, err)
+	expectEquals(t, len(connData), 0)
+
+	u, err := url.Parse(loginURL)
+	expectNil(t, err)
+	expectEquals(t, u.EscapedPath(), "/callback/test%2Fconnector")
+	expectEquals(t, u.Query().Get("state"), "some-state")
+}
+
 func TestExtraHeaders(t *testing.T) {
 	config := Config{}
 
@@ -62,7 +79,7 @@ func TestExtraHeaders(t *testing.T) {
 		"X-Remote-User-Email": {testEmail},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testUserID)
@@ -85,7 +102,7 @@ func TestSingleGroup(t *testing.T) {
 		"X-Remote-Group": {testGroup1},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
@@ -106,7 +123,7 @@ func TestMultipleGroup(t *testing.T) {
 		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
@@ -132,7 +149,7 @@ func TestMultipleGroupWithCustomSeparator(t *testing.T) {
 		"X-Remote-Group": {testGroup1 + ";" + testGroup2 + ";" + testGroup3 + ";" + testGroup4},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
@@ -158,7 +175,7 @@ func TestStaticGroup(t *testing.T) {
 		"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
 	}
 
-	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req)
+	ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
 	expectNil(t, err)
 
 	expectEquals(t, ident.UserID, testEmail)
diff --git a/connector/oauth/oauth.go b/connector/oauth/oauth.go
index 413a813..6adae65 100644
--- a/connector/oauth/oauth.go
+++ b/connector/oauth/oauth.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"strings"
 
 	"golang.org/x/oauth2"
@@ -30,6 +31,8 @@ type oauthConnector struct {
 	emailKey             string
 	emailVerifiedKey     string
 	groupsKey            string
+	pathSuffix           string
+	rawPathSuffix        string
 	httpClient           *http.Client
 	logger               *slog.Logger
 }
@@ -106,6 +109,8 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 		groupsKey:            groupsKey,
 		emailKey:             emailKey,
 		emailVerifiedKey:     emailVerifiedKey,
+		pathSuffix:           "/" + id,
+		rawPathSuffix:        "/" + url.PathEscape(id),
 	}
 
 	oauthConn.httpClient, err = httpclient.NewHTTPClient(c.RootCAs, c.InsecureSkipVerify)
@@ -116,9 +121,20 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
 	return oauthConn, err
 }
 
-func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) {
-	if c.redirectURI != callbackURL {
-		return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
+var _ connector.CallbackConnector = (*oauthConnector)(nil)
+
+func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
+	u, err := url.Parse(callbackURL)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
+	}
+	escapedPath := u.EscapedPath()
+	u.Path += c.pathSuffix
+	u.RawPath = escapedPath + c.rawPathSuffix
+	connectorCallbackURL := u.String()
+
+	if c.redirectURI != connectorCallbackURL {
+		return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", connectorCallbackURL, c.redirectURI)
 	}
 
 	oauth2Config := &oauth2.Config{
@@ -129,10 +145,10 @@ func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state st
 		Scopes:       c.scopes,
 	}
 
-	return oauth2Config.AuthCodeURL(state), nil
+	return oauth2Config.AuthCodeURL(state), nil, nil
 }
 
-func (c *oauthConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) {
+func (c *oauthConnector) HandleCallback(s connector.Scopes, connData []byte, r *http.Request) (identity connector.Identity, err error) {
 	q := r.URL.Query()
 	if errType := q.Get("error"); errType != "" {
 		return identity, errors.New(q.Get("error_description"))
diff --git a/connector/oauth/oauth_test.go b/connector/oauth/oauth_test.go
index 2f6b0b9..4c3ff8f 100644
--- a/connector/oauth/oauth_test.go
+++ b/connector/oauth/oauth_test.go
@@ -32,7 +32,7 @@ func TestOpen(t *testing.T) {
 
 	assert.Equal(t, conn.clientID, "testClient")
 	assert.Equal(t, conn.clientSecret, "testSecret")
-	assert.Equal(t, conn.redirectURI, testServer.URL+"/callback")
+	assert.Equal(t, conn.redirectURI, testServer.URL+"/callback/id")
 	assert.Equal(t, conn.tokenURL, testServer.URL+"/token")
 	assert.Equal(t, conn.authorizationURL, testServer.URL+"/authorize")
 	assert.Equal(t, conn.userInfoURL, testServer.URL+"/userinfo")
@@ -50,8 +50,9 @@ func TestLoginURL(t *testing.T) {
 
 	conn := newConnector(t, testServer.URL)
 
-	loginURL, err := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
+	loginURL, connData, err := conn.LoginURL(connector.Scopes{}, testServer.URL+"/callback", "some-state")
 	assert.Equal(t, err, nil)
+	assert.Equal(t, len(connData), 0)
 
 	expectedURL, err := url.Parse(testServer.URL + "/authorize")
 	assert.Equal(t, err, nil)
@@ -86,7 +87,7 @@ func TestHandleCallBackForGroupsInUserInfo(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInUserInfo")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	sort.Strings(identity.Groups)
@@ -122,7 +123,7 @@ func TestHandleCallBackForGroupMapsInUserInfo(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupMapsInUserInfo")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	sort.Strings(identity.Groups)
@@ -156,7 +157,7 @@ func TestHandleCallBackForGroupsInToken(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInToken")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	assert.Equal(t, len(identity.Groups), 1)
@@ -186,7 +187,7 @@ func TestHandleCallbackForNumericUserID(t *testing.T) {
 	conn := newConnector(t, testServer.URL)
 	req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallbackForNumericUserID")
 
-	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req)
+	identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
 	assert.Equal(t, err, nil)
 
 	assert.Equal(t, identity.UserID, "1000")
@@ -257,7 +258,7 @@ func newConnector(t *testing.T, serverURL string) *oauthConnector {
 	testConfig := Config{
 		ClientID:         "testClient",
 		ClientSecret:     "testSecret",
-		RedirectURI:      serverURL + "/callback",
+		RedirectURI:      serverURL + "/callback/id",
 		TokenURL:         serverURL + "/token",
 		AuthorizationURL: serverURL + "/authorize",
 		UserInfoURL:      serverURL + "/userinfo",

diff --git a/upstream/doh.go b/upstream/doh.go
index 239aa47..3092cd4 100644
--- a/upstream/doh.go
+++ b/upstream/doh.go
@@ -620,10 +620,13 @@ func (p *dnsOverHTTPS) probeH3(
 	probeTLSCfg.VerifyConnection = nil
 
 	// Run probeQUIC and probeTLS in parallel and see which one is faster.
+	// Each goroutine must use its own *tls.Config clone, since a *tls.Config
+	// is not safe for concurrent use by the QUIC and TLS handshakes that run
+	// simultaneously below.
 	chQUIC := make(chan error, 1)
 	chTLS := make(chan error, 1)
-	go p.probeQUIC(addr, probeTLSCfg, chQUIC)
-	go p.probeTLS(dialContext, probeTLSCfg, chTLS)
+	go p.probeQUIC(addr, probeTLSCfg.Clone(), chQUIC)
+	go p.probeTLS(dialContext, probeTLSCfg.Clone(), chTLS)
 
 	select {
 	case quicErr := <-chQUIC:

diff --git a/internal/cmd/proxy.go b/internal/cmd/proxy.go
index d3ac625..9473fa8 100644
--- a/internal/cmd/proxy.go
+++ b/internal/cmd/proxy.go
@@ -524,6 +524,8 @@ func loadServersList(sources []string) []string {
 		if err != nil {
 			// Ignore errors, just consider it a server address and not a file.
 			servers = append(servers, source)
+
+			continue
 		}
 
 		lines := strings.Split(string(data), "\n")
diff --git a/upstream/doh.go b/upstream/doh.go
index 239aa47..3f9e54f 100644
--- a/upstream/doh.go
+++ b/upstream/doh.go
@@ -157,10 +157,11 @@ func (p *dnsOverHTTPS) Exchange(req *dns.Msg) (resp *dns.Msg, err error) {
 	//
 	// See https://www.rfc-editor.org/rfc/rfc8484.html.
 	id := req.Id
+	req = req.Copy()
 	req.Id = 0
 	defer func() {
-		// Restore the original ID to not break compatibility with proxies.
-		req.Id = id
+		// Restore the original ID in the response to not break compatibility
+		// with proxies.
 		if resp != nil {
 			resp.Id = id
 		}
diff --git a/upstream/doq.go b/upstream/doq.go
index f0ec7bb..baf6e94 100644
--- a/upstream/doq.go
+++ b/upstream/doq.go
@@ -174,10 +174,11 @@ func (p *dnsOverQUIC) Exchange(req *dns.Msg) (resp *dns.Msg, err error) {
 	//
 	// See https://www.rfc-editor.org/rfc/rfc9250#section-4.2.1.
 	id := req.Id
+	req = req.Copy()
 	req.Id = 0
 	defer func() {
-		// Restore the original ID to not break compatibility with proxies.
-		req.Id = id
+		// Restore the original ID in the response to not break compatibility
+		// with proxies.
 		if resp != nil {
 			resp.Id = id
 		}
@@ -285,7 +286,7 @@ func (p *dnsOverQUIC) getBytesPool() (pool *sync.Pool) {
 
 	if p.bytesPool == nil {
 		p.bytesPool = &sync.Pool{
-			New: func() interface{} {
+			New: func() (res any) {
 				b := make([]byte, dns.MaxMsgSize)
 
 				return &b
diff --git a/upstream/plain.go b/upstream/plain.go
index eb932a6..1d78e75 100644
--- a/upstream/plain.go
+++ b/upstream/plain.go
@@ -91,6 +91,8 @@ func (p *plainDNS) dialExchange(
 	dial bootstrap.DialHandler,
 	req *dns.Msg,
 ) (resp *dns.Msg, err error) {
+	req = req.Copy()
+
 	addr := p.Address()
 	client := &dns.Client{Timeout: p.timeout}
 

diff --git a/dulwich/merge_drivers.py b/dulwich/merge_drivers.py
index 0e327ea..269deee 100644
--- a/dulwich/merge_drivers.py
+++ b/dulwich/merge_drivers.py
@@ -29,6 +29,7 @@ __all__ = [
 ]
 
 import os
+import shlex
 import subprocess
 import tempfile
 from collections.abc import Callable
@@ -110,14 +111,17 @@ class ProcessMergeDriver:
             with open(theirs_path, "wb") as f:
                 f.write(theirs)
 
-            # Prepare command with placeholders
+            # Prepare command with placeholders. The substituted values are
+            # shell-quoted so that paths containing shell metacharacters (in
+            # particular the repository-controlled %P) cannot be used to inject
+            # additional commands into the shell invocation below.
             cmd = self.command
-            cmd = cmd.replace("%O", ancestor_path)
-            cmd = cmd.replace("%A", ours_path)
-            cmd = cmd.replace("%B", theirs_path)
-            cmd = cmd.replace("%L", str(marker_size))
+            cmd = cmd.replace("%O", shlex.quote(ancestor_path))
+            cmd = cmd.replace("%A", shlex.quote(ours_path))
+            cmd = cmd.replace("%B", shlex.quote(theirs_path))
+            cmd = cmd.replace("%L", shlex.quote(str(marker_size)))
             if path:
-                cmd = cmd.replace("%P", path)
+                cmd = cmd.replace("%P", shlex.quote(path))
 
             # Execute merge command
             try:

diff --git a/dulwich/merge_drivers.py b/dulwich/merge_drivers.py
index 0e327ea..d1253ac 100644
--- a/dulwich/merge_drivers.py
+++ b/dulwich/merge_drivers.py
@@ -29,6 +29,7 @@ __all__ = [
 ]
 
 import os
+import shlex
 import subprocess
 import tempfile
 from collections.abc import Callable
@@ -77,6 +78,52 @@ class ProcessMergeDriver:
         self.command = command
         self.name = name
 
+    def _command_args(
+        self,
+        ancestor_path: str,
+        ours_path: str,
+        theirs_path: str,
+        path: str | None,
+        marker_size: int,
+    ) -> list[str]:
+        """Build subprocess arguments with placeholders expanded."""
+        args = shlex.split(self.command, posix=(os.name != "nt"))
+        replacements = {
+            "%O": ancestor_path,
+            "%A": ours_path,
+            "%B": theirs_path,
+            "%L": str(marker_size),
+        }
+        if path:
+            replacements["%P"] = path
+        return [self._replace_placeholders(arg, replacements) for arg in args]
+
+    @staticmethod
+    def _replace_placeholders(arg: str, replacements: dict[str, str]) -> str:
+        for placeholder, value in replacements.items():
+            arg = arg.replace(placeholder, value)
+        return arg
+
+    @staticmethod
+    def _extract_stdout_redirect(args: list[str]) -> tuple[list[str], str | None, str]:
+        """Extract simple shell-style stdout redirection from arguments."""
+        stdout_path = None
+        stdout_mode = "wb"
+        cleaned_args = []
+        i = 0
+        while i < len(args):
+            arg = args[i]
+            if arg in (">", ">>"):
+                if stdout_path is not None or i + 1 >= len(args):
+                    raise ValueError("invalid stdout redirection")
+                stdout_path = args[i + 1]
+                stdout_mode = "ab" if arg == ">>" else "wb"
+                i += 2
+                continue
+            cleaned_args.append(arg)
+            i += 1
+        return cleaned_args, stdout_path, stdout_mode
+
     def merge(
         self,
         ancestor: bytes,
@@ -110,23 +157,27 @@ class ProcessMergeDriver:
             with open(theirs_path, "wb") as f:
                 f.write(theirs)
 
-            # Prepare command with placeholders
-            cmd = self.command
-            cmd = cmd.replace("%O", ancestor_path)
-            cmd = cmd.replace("%A", ours_path)
-            cmd = cmd.replace("%B", theirs_path)
-            cmd = cmd.replace("%L", str(marker_size))
-            if path:
-                cmd = cmd.replace("%P", path)
+            args = self._command_args(
+                ancestor_path, ours_path, theirs_path, path, marker_size
+            )
+            args, stdout_path, stdout_mode = self._extract_stdout_redirect(args)
 
             # Execute merge command
             try:
-                result = subprocess.run(
-                    cmd,
-                    shell=True,
-                    capture_output=True,
-                    text=False,
-                )
+                if stdout_path is None:
+                    result = subprocess.run(
+                        args,
+                        capture_output=True,
+                        text=False,
+                    )
+                else:
+                    with open(stdout_path, stdout_mode) as stdout:
+                        result = subprocess.run(
+                            args,
+                            stdout=stdout,
+                            stderr=subprocess.PIPE,
+                            text=False,
+                        )
 
                 # Read merged content from ours file
                 with open(ours_path, "rb") as f:
@@ -137,7 +188,7 @@ class ProcessMergeDriver:
 
                 return merged_content, success
 
-            except subprocess.SubprocessError:
+            except (OSError, ValueError, subprocess.SubprocessError):
                 # If the command fails completely, return original with conflicts
                 return ours, False
 
diff --git a/tests/test_merge_drivers.py b/tests/test_merge_drivers.py
index 9b480bf..caba0c9 100644
--- a/tests/test_merge_drivers.py
+++ b/tests/test_merge_drivers.py
@@ -21,6 +21,7 @@
 """Tests for merge driver support."""
 
 import importlib.util
+import os
 import sys
 import unittest
 
@@ -205,6 +206,20 @@ class ProcessMergeDriverTests(unittest.TestCase):
         self.assertEqual(result, expected)
         self.assertTrue(success)
 
+    def test_merge_path_does_not_inject_shell_commands(self):
+        """Test that merge driver placeholders are not interpreted by a shell."""
+        marker = os.path.join(os.getcwd(), "merge-driver-injection-marker")
+        self.addCleanup(lambda: os.path.exists(marker) and os.remove(marker))
+        command = f"echo path: %P > %A ; touch {marker}"
+        driver = ProcessMergeDriver(command, "path_driver")
+
+        result, success = driver.merge(b"a", b"b", b"c", path="dir/file.xml")
+
+        self.assertFalse(os.path.exists(marker))
+        self.assertIn(b"path: dir/file.xml", result)
+        self.assertIn(f"; touch {marker}".encode(), result)
+        self.assertTrue(success)
+
 
 class MergeBlobsWithDriversTests(unittest.TestCase):
     """Tests for merge_blobs with merge drivers."""

diff --git a/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java b/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
index bb73e05..71f2d6d 100644
--- a/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
+++ b/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
@@ -42,7 +42,7 @@ public class SignedPublicKeysTrustValidatorImpl implements SignedPublicKeysTrust
 
       // https://www.rfc-editor.org/rfc/rfc7515.html#appendix-A.3.1
       var signatureDer = ECDSA.transcodeSignatureToDER(signedPublicKeys.signatureEs256());
-      ecdsa.verify(signatureDer);
+      return ecdsa.verify(signatureDer);
 
     } catch (CertificateValidationException
         | InvalidKeyException
@@ -53,6 +53,5 @@ public class SignedPublicKeysTrustValidatorImpl implements SignedPublicKeysTrust
       log.atDebug().setCause(e).log("failed to validate certificate: {}", e.getMessage());
       return false;
     }
-    return true;
   }
 }

diff --git a/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java b/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
index bb73e05..cd5f7d6 100644
--- a/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
+++ b/vau/vau-httpclient/src/main/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImpl.java
@@ -42,7 +42,9 @@ public class SignedPublicKeysTrustValidatorImpl implements SignedPublicKeysTrust
 
       // https://www.rfc-editor.org/rfc/rfc7515.html#appendix-A.3.1
       var signatureDer = ECDSA.transcodeSignatureToDER(signedPublicKeys.signatureEs256());
-      ecdsa.verify(signatureDer);
+      if (!ecdsa.verify(signatureDer)) {
+        throw new SignatureException("invalid signed public keys signature");
+      }
 
     } catch (CertificateValidationException
         | InvalidKeyException
diff --git a/vau/vau-httpclient/src/test/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImplTest.java b/vau/vau-httpclient/src/test/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImplTest.java
new file mode 100644
index 0000000..7f025e0
--- /dev/null
+++ b/vau/vau-httpclient/src/test/java/com/oviva/telematik/vau/httpclient/internal/SignedPublicKeysTrustValidatorImplTest.java
@@ -0,0 +1,72 @@
+package com.oviva.telematik.vau.httpclient.internal;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+import com.fasterxml.jackson.dataformat.cbor.databind.CBORMapper;
+import com.oviva.telematik.vau.httpclient.HttpClient;
+import com.oviva.telematik.vau.httpclient.HttpResponse;
+import com.oviva.telematik.vau.httpclient.internal.cert.CertDataResponse;
+import com.oviva.telematik.vau.httpclient.internal.cert.TrustValidator;
+import de.gematik.vau.lib.data.SignedPublicKeysTrustValidator.SignedPublicKeys;
+import java.io.IOException;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.Security;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.util.io.pem.PemObject;
+import org.bouncycastle.util.io.pem.PemReader;
+import org.junit.jupiter.api.Test;
+
+class SignedPublicKeysTrustValidatorImplTest {
+
+  static {
+    Security.addProvider(new BouncyCastleProvider());
+  }
+
+  @Test
+  void isTrustedReturnsFalseWhenSignatureVerificationFails() throws IOException {
+    var certDataResponse =
+        new CertDataResponse(
+            loadFirstPemObject("src/test/resources/cert.pem"),
+            loadFirstPemObject("src/test/resources/ca.pem"),
+            loadPemObjects("src/test/resources/chain.pem"));
+    var certDataResponseBody = new CBORMapper().writeValueAsBytes(certDataResponse);
+    HttpClient outerClient = req -> new HttpResponse(200, List.of(), certDataResponseBody);
+    TrustValidator trustValidator = (cert, issuerCa, certificateChain, ocspResponseDer) -> {};
+    var validator =
+        new SignedPublicKeysTrustValidatorImpl(
+            outerClient, trustValidator, URI.create("https://example.test/vau"));
+
+    var invalidSignature = new byte[64];
+    Arrays.fill(invalidSignature, (byte) 1);
+
+    assertFalse(
+        validator.isTrusted(
+            new SignedPublicKeys(
+                "signed-public-keys".getBytes(StandardCharsets.UTF_8),
+                invalidSignature,
+                new byte[] {1, 2, 3},
+                1,
+                new byte[] {4, 5, 6})));
+  }
+
+  private static byte[] loadFirstPemObject(String path) throws IOException {
+    return loadPemObjects(path).get(0);
+  }
+
+  private static List<byte[]> loadPemObjects(String path) throws IOException {
+    try (var reader = new PemReader(Files.newBufferedReader(Path.of(path)))) {
+      var objects = new ArrayList<byte[]>();
+      PemObject pemObject;
+      while ((pemObject = reader.readPemObject()) != null) {
+        objects.add(pemObject.getContent());
+      }
+      return objects;
+    }
+  }
+}

diff --git a/src/middleware/ip-restriction/index.ts b/src/middleware/ip-restriction/index.ts
index 9ebf306..35f7c51 100644
--- a/src/middleware/ip-restriction/index.ts
+++ b/src/middleware/ip-restriction/index.ts
@@ -35,7 +35,7 @@ type GetIPAddr = GetConnInfo | ((c: Context) => string)
 type IPRestrictionRuleFunction = (addr: { addr: string; type: AddressType }) => boolean
 export type IPRestrictionRule = string | ((addr: { addr: string; type: AddressType }) => boolean)
 
-const IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/
+const IS_CIDR_NOTATION_REGEX = /\/[0-9]{1,3}$/
 const buildMatcher = (
   rules: IPRestrictionRule[]
 ): ((addr: { addr: string; type: AddressType; isIPv4: boolean }) => boolean) => {

diff --git a/src/middleware/ip-restriction/index.test.ts b/src/middleware/ip-restriction/index.test.ts
index 6f54095..3c1ef43 100644
--- a/src/middleware/ip-restriction/index.test.ts
+++ b/src/middleware/ip-restriction/index.test.ts
@@ -60,6 +60,25 @@ describe('ipRestriction middleware', () => {
       expect(await res.text()).toBe('error')
     }
   })
+
+  it('Should block invalid remote addresses', async () => {
+    const app = new Hono<{
+      Bindings: {
+        ip: string
+      }
+    }>()
+    app.use(
+      '/basic',
+      ipRestriction((c) => c.env.ip, {
+        allowList: ['::1'],
+      })
+    )
+    app.get('/basic', (c) => c.text('Hello World!'))
+
+    expect((await app.request('/basic', {}, { ip: 'example.com:443' })).status).toBe(403)
+    expect((await app.request('/basic', {}, { ip: '1234:::5678' })).status).toBe(403)
+    expect((await app.request('/basic', {}, { ip: '::1' })).status).toBe(200)
+  })
 })
 
 describe('isMatchForRule', () => {
@@ -115,6 +134,16 @@ describe('isMatchForRule', () => {
       await isMatch({ addr: '::ffff:192.168.1.1', type: 'IPv6' }, '::ffff:0:0/95')
     ).toBeTruthy()
   })
+  it('Invalid CIDR Notation', () => {
+    expect(() => ipRestriction(() => '127.0.0.1', { allowList: ['127.0.0.1/'] })).toThrow(
+      TypeError
+    )
+    expect(() => ipRestriction(() => '127.0.0.1', { allowList: ['127.0.0.1/33'] })).toThrow(
+      TypeError
+    )
+    expect(() => ipRestriction(() => '::1', { allowList: ['::1/129'] })).toThrow(TypeError)
+    expect(() => ipRestriction(() => '::1', { allowList: ['::1/foo'] })).toThrow(TypeError)
+  })
   it('Static Rules', async () => {
     expect(await isMatch({ addr: '192.168.2.1', type: 'IPv4' }, '192.168.2.1')).toBeTruthy()
     expect(await isMatch({ addr: '1234::5678', type: 'IPv6' }, '1234::5678')).toBeTruthy()
diff --git a/src/middleware/ip-restriction/index.ts b/src/middleware/ip-restriction/index.ts
index 9ebf306..8433d96 100644
--- a/src/middleware/ip-restriction/index.ts
+++ b/src/middleware/ip-restriction/index.ts
@@ -35,7 +35,30 @@ type GetIPAddr = GetConnInfo | ((c: Context) => string)
 type IPRestrictionRuleFunction = (addr: { addr: string; type: AddressType }) => boolean
 export type IPRestrictionRule = string | ((addr: { addr: string; type: AddressType }) => boolean)
 
-const IS_CIDR_NOTATION_REGEX = /\/[0-9]{0,3}$/
+const parseCIDRRule = (rule: string): [string, number] | undefined => {
+  const separatorIndex = rule.indexOf('/')
+  if (separatorIndex === -1) {
+    return
+  }
+  if (separatorIndex !== rule.lastIndexOf('/')) {
+    throw new TypeError(`Invalid rule: ${rule}`)
+  }
+
+  const addr = rule.slice(0, separatorIndex)
+  const prefix = rule.slice(separatorIndex + 1)
+  if (prefix.length === 0 || prefix.length > 3) {
+    throw new TypeError(`Invalid rule: ${rule}`)
+  }
+  for (let i = 0; i < prefix.length; i++) {
+    const code = prefix.charCodeAt(i)
+    if (code < 48 || code > 57) {
+      throw new TypeError(`Invalid rule: ${rule}`)
+    }
+  }
+
+  return [addr, Number(prefix)]
+}
+
 const buildMatcher = (
   rules: IPRestrictionRule[]
 ): ((addr: { addr: string; type: AddressType; isIPv4: boolean }) => boolean) => {
@@ -49,19 +72,25 @@ const buildMatcher = (
     } else if (typeof rule === 'function') {
       functionRules.push(rule)
     } else {
-      if (IS_CIDR_NOTATION_REGEX.test(rule)) {
-        const separatedRule = rule.split('/')
-
-        const addrStr = separatedRule[0]
+      if (rule.includes('/')) {
+        const cidrRule = parseCIDRRule(rule)
+        if (cidrRule === undefined) {
+          throw new TypeError(`Invalid rule: ${rule}`)
+        }
+        const [addrStr, parsedPrefix] = cidrRule
         const type = distinctRemoteAddr(addrStr)
         if (type === undefined) {
           throw new TypeError(`Invalid rule: ${rule}`)
         }
 
         let isIPv4 = type === 'IPv4'
-        let prefix = parseInt(separatedRule[1])
+        let prefix = parsedPrefix
+        const maxPrefix = isIPv4 ? 32 : 128
+        if (prefix > maxPrefix) {
+          throw new TypeError(`Invalid rule: ${rule}`)
+        }
 
-        if (isIPv4 ? prefix === 32 : prefix === 128) {
+        if (prefix === maxPrefix) {
           // this rule is a static rule
           rule = addrStr
         } else {
@@ -216,8 +245,11 @@ export const ipRestriction = (
     if (!addr) {
       throw blockError(c)
     }
-    const type =
-      (typeof connInfo !== 'string' && connInfo.remote.addressType) || distinctRemoteAddr(addr)
+    const inferredType = distinctRemoteAddr(addr)
+    const type = (typeof connInfo !== 'string' && connInfo.remote.addressType) || inferredType
+    if (type === undefined || inferredType !== type) {
+      throw blockError(c)
+    }
 
     const remoteData = { addr, type, isIPv4: type === 'IPv4' }
 
diff --git a/src/utils/ipaddr.test.ts b/src/utils/ipaddr.test.ts
index 9636be5..914ea2c 100644
--- a/src/utils/ipaddr.test.ts
+++ b/src/utils/ipaddr.test.ts
@@ -16,6 +16,12 @@ describe('expandIPv6', () => {
     expect(expandIPv6('2001:0:0:db8::1')).toBe('2001:0000:0000:0db8:0000:0000:0000:0001')
     expect(expandIPv6('::ffff:127.0.0.1')).toBe('0000:0000:0000:0000:0000:ffff:7f00:0001')
   })
+
+  it('Should reject invalid IPv6 addresses', () => {
+    expect(() => expandIPv6('1234:::5678')).toThrow(TypeError)
+    expect(() => expandIPv6('1:2:3:4:5:6:7:8:9')).toThrow(TypeError)
+    expect(() => expandIPv6('::ffff:127.0.0.256')).toThrow(TypeError)
+  })
 })
 describe('distinctRemoteAddr', () => {
   it('Should result be valid', () => {
@@ -29,6 +35,13 @@ describe('distinctRemoteAddr', () => {
     expect(distinctRemoteAddr('example.com')).toBeUndefined()
   })
 
+  it('Should reject invalid IPv6 addresses', () => {
+    expect(distinctRemoteAddr('1234:::5678')).toBeUndefined()
+    expect(distinctRemoteAddr('1:2:3:4:5:6:7:8:9')).toBeUndefined()
+    expect(distinctRemoteAddr('::ffff:127.0.0.256')).toBeUndefined()
+    expect(distinctRemoteAddr('example.com:443')).toBeUndefined()
+  })
+
   it('Should reject invalid IPv4 addresses with octets > 255', () => {
     expect(distinctRemoteAddr('1.2.3.256')).toBeUndefined()
     expect(distinctRemoteAddr('1.2.3.999')).toBeUndefined()
@@ -51,6 +64,12 @@ describe('convertIPv4ToBinary', () => {
 
     expect(convertIPv4ToBinary('0.0.1.0')).toBe(1n << 8n)
   })
+
+  it('Should reject invalid IPv4 addresses', () => {
+    expect(() => convertIPv4ToBinary('1.2.3.256')).toThrow(TypeError)
+    expect(() => convertIPv4ToBinary('01.2.3.4')).toThrow(TypeError)
+    expect(() => convertIPv4ToBinary('1.2.3')).toThrow(TypeError)
+  })
 })
 
 describe('convertIPv4ToString', () => {
@@ -71,9 +90,14 @@ describe('convertIPv6ToBinary', () => {
     expect(convertIPv6ToBinary('::1')).toBe(1n)
 
     expect(convertIPv6ToBinary('::f')).toBe(15n)
-    expect(convertIPv6ToBinary('1234:::5678')).toBe(24196103360772296748952112894165669496n)
     expect(convertIPv6ToBinary('::ffff:127.0.0.1')).toBe(281472812449793n)
   })
+
+  it('Should reject invalid IPv6 addresses', () => {
+    expect(() => convertIPv6ToBinary('1234:::5678')).toThrow(TypeError)
+    expect(() => convertIPv6ToBinary('gggg::1')).toThrow(TypeError)
+    expect(() => convertIPv6ToBinary('::ffff:999.0.0.1')).toThrow(TypeError)
+  })
 })
 
 describe('convertIPv6ToString', () => {
@@ -82,7 +106,6 @@ describe('convertIPv6ToString', () => {
     input                                        | expected
     ${'::1'}                                     | ${'::1'}
     ${'1::'}                                     | ${'1::'}
-    ${'1234:::5678'}                             | ${'1234::5678'}
     ${'2001:2::'}                                | ${'2001:2::'}
     ${'2001::db8:0:0:0:0:1'}                     | ${'2001:0:db8::1'}
     ${'1234:5678:9abc:def0:1234:5678:9abc:def0'} | ${'1234:5678:9abc:def0:1234:5678:9abc:def0'}
diff --git a/src/utils/ipaddr.ts b/src/utils/ipaddr.ts
index 97b2bf2..5a7801a 100644
--- a/src/utils/ipaddr.ts
+++ b/src/utils/ipaddr.ts
@@ -5,47 +5,122 @@
 
 import type { AddressType } from '../helper/conninfo'
 
+const parseIPv4ToParts = (ipv4: string): number[] | undefined => {
+  const parts = ipv4.split('.')
+  if (parts.length !== 4) {
+    return
+  }
+
+  const parsed: number[] = []
+  for (const part of parts) {
+    if (part.length === 0 || (part.length > 1 && part[0] === '0')) {
+      return
+    }
+
+    let value = 0
+    for (let i = 0; i < part.length; i++) {
+      const code = part.charCodeAt(i)
+      if (code < 48 || code > 57) {
+        return
+      }
+      value = value * 10 + code - 48
+    }
+
+    if (value > 255) {
+      return
+    }
+    parsed.push(value)
+  }
+
+  return parsed
+}
+
+const isIPv6Segment = (segment: string): boolean => {
+  if (segment.length === 0 || segment.length > 4) {
+    return false
+  }
+  for (let i = 0; i < segment.length; i++) {
+    const code = segment.charCodeAt(i)
+    if (
+      !(
+        (code >= 48 && code <= 57) ||
+        (code >= 65 && code <= 70) ||
+        (code >= 97 && code <= 102)
+      )
+    ) {
+      return false
+    }
+  }
+  return true
+}
+
+const parseIPv6ToParts = (ipv6: string): number[] | undefined => {
+  let addr = ipv6
+  const ipv4Start = ipv6.lastIndexOf(':')
+  const hasIPv4Part = ipv6.includes('.')
+  const ipv4Parts =
+    hasIPv4Part && ipv4Start !== -1 ? parseIPv4ToParts(ipv6.slice(ipv4Start + 1)) : undefined
+  if (hasIPv4Part && ipv4Parts === undefined) {
+    return
+  }
+  if (ipv4Parts) {
+    addr = `${ipv6.slice(0, ipv4Start)}:${((ipv4Parts[0] << 8) | ipv4Parts[1]).toString(
+      16
+    )}:${((ipv4Parts[2] << 8) | ipv4Parts[3]).toString(16)}`
+  }
+
+  const compressed = addr.split('::')
+  if (compressed.length > 2) {
+    return
+  }
+
+  const left = compressed[0] ? compressed[0].split(':') : []
+  const right = compressed.length === 2 && compressed[1] ? compressed[1].split(':') : []
+  if (left.some((part) => !isIPv6Segment(part)) || right.some((part) => !isIPv6Segment(part))) {
+    return
+  }
+
+  if (compressed.length === 1) {
+    if (left.length !== 8) {
+      return
+    }
+    return left.map((part) => parseInt(part, 16))
+  }
+
+  const zeroCount = 8 - left.length - right.length
+  if (zeroCount <= 0) {
+    return
+  }
+
+  return [
+    ...left.map((part) => parseInt(part, 16)),
+    ...new Array(zeroCount).fill(0),
+    ...right.map((part) => parseInt(part, 16)),
+  ]
+}
+
 /**
  * Expand IPv6 Address
  * @param ipV6 Shorten IPv6 Address
  * @return expanded IPv6 Address
  */
 export const expandIPv6 = (ipV6: string): string => {
-  const sections = ipV6.split(':')
-  if (IPV4_REGEX.test(sections.at(-1) as string)) {
-    sections.splice(
-      -1,
-      1,
-      ...convertIPv6BinaryToString(convertIPv4ToBinary(sections.at(-1) as string)) // => ::7f00:0001
-        .substring(2) // => 7f00:0001
-        .split(':') // => ['7f00', '0001']
-    )
-  }
-  for (let i = 0; i < sections.length; i++) {
-    const node = sections[i]
-    if (node !== '') {
-      sections[i] = node.padStart(4, '0')
-    } else {
-      sections[i + 1] === '' && sections.splice(i + 1, 1)
-      sections[i] = new Array(8 - sections.length + 1).fill('0000').join(':')
-    }
+  const parts = parseIPv6ToParts(ipV6)
+  if (parts === undefined) {
+    throw new TypeError(`Invalid IPv6 address: ${ipV6}`)
   }
-  return sections.join(':')
+  return parts.map((part) => part.toString(16).padStart(4, '0')).join(':')
 }
 
-const IPV4_OCTET_PART = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])'
-const IPV4_REGEX = new RegExp(`^(?:${IPV4_OCTET_PART}\\.){3}${IPV4_OCTET_PART}$`)
-
 /**
  * Distinct Remote Addr
  * @param remoteAddr Remote Addr
  */
 export const distinctRemoteAddr = (remoteAddr: string): AddressType => {
-  if (IPV4_REGEX.test(remoteAddr)) {
+  if (parseIPv4ToParts(remoteAddr)) {
     return 'IPv4'
   }
-  if (remoteAddr.includes(':')) {
-    // Domain can't include `:`
+  if (parseIPv6ToParts(remoteAddr)) {
     return 'IPv6'
   }
 }
@@ -56,7 +131,10 @@ export const distinctRemoteAddr = (remoteAddr: string): AddressType => {
  * @returns BigInt
  */
 export const convertIPv4ToBinary = (ipv4: string): bigint => {
-  const parts = ipv4.split('.')
+  const parts = parseIPv4ToParts(ipv4)
+  if (parts === undefined) {
+    throw new TypeError(`Invalid IPv4 address: ${ipv4}`)
+  }
   let result = 0n
   for (let i = 0; i < 4; i++) {
     result <<= 8n
@@ -71,11 +149,14 @@ export const convertIPv4ToBinary = (ipv4: string): bigint => {
  * @returns BigInt
  */
 export const convertIPv6ToBinary = (ipv6: string): bigint => {
-  const sections = expandIPv6(ipv6).split(':')
+  const parts = parseIPv6ToParts(ipv6)
+  if (parts === undefined) {
+    throw new TypeError(`Invalid IPv6 address: ${ipv6}`)
+  }
   let result = 0n
   for (let i = 0; i < 8; i++) {
     result <<= 16n
-    result += BigInt(parseInt(sections[i], 16))
+    result += BigInt(parts[i])
   }
   return result
 }

diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
index 1c1224d..ddaf37f 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
@@ -207,7 +207,17 @@ public void processChallenge(
 
         if (authChallenge == null) {
             if (!challenged) {
-                // Final response with no Authentication-Info: nothing to do
+                // Final response with no Authentication-Info.
+                if (this.state == State.CLIENT_FINAL_SENT) {
+                    // We have sent the client-final message and MUST verify the server's
+                    // signature ('v') before considering authentication successful. Its
+                    // absence means mutual authentication cannot be completed, so the
+                    // response must be rejected (RFC 7804 / RFC 5802).
+                    this.state = State.FAILED;
+                    throw new AuthenticationException(
+                            "SCRAM server signature missing: no Authentication-Info in final response");
+                }
+                // Not awaiting server verification: nothing to do
                 return;
             }
             throw new MalformedChallengeException("Null SCRAM challenge");
@@ -289,6 +299,13 @@ public void processChallenge(
         // For Authentication-Info, RFC 7804 does NOT mandate a scheme token; do NOT enforce scheme name here.
         final String data = params.get("data");
         if (data == null) {
+            if (this.state == State.CLIENT_FINAL_SENT) {
+                // Awaiting server verification: a final response without data cannot carry
+                // the server signature, so mutual authentication fails.
+                this.state = State.FAILED;
+                throw new AuthenticationException(
+                        "SCRAM server signature missing: no data in final response");
+            }
             return;
         }
         final String decoded = b64ToString(data);
@@ -303,6 +320,14 @@ public void processChallenge(
         }
         final String vB64 = attrs.get("v");
         if (vB64 == null) {
+            if (this.state == State.CLIENT_FINAL_SENT) {
+                // The server signature ('v') is mandatory once the client-final message has
+                // been sent. Without it the server cannot be authenticated, so fail closed
+                // rather than silently accepting the response.
+                this.state = State.FAILED;
+                throw new AuthenticationException(
+                        "SCRAM server signature ('v') missing from final response");
+            }
             return;
         }
 
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
index ae383e5..fdaade7 100644
--- a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
@@ -335,6 +335,80 @@ void strictScram_authInfo_mismatchV_fails() throws Exception {
         assertTrue(ex.getMessage().toLowerCase(Locale.ROOT).contains("signature"));
     }
 
+    @Test
+    void strictScram_authInfo_missingV_fails() throws Exception {
+        // Mutual authentication must NOT succeed if the server omits its signature ('v')
+        // from the final response after the client-final message has been sent (CWE-304).
+        final ScramScheme scheme = new ScramScheme();
+        final BasicCredentialsProvider creds = new BasicCredentialsProvider();
+        creds.setCredentials(new AuthScope(HOST, REALM, scheme.getName()),
+                new UsernamePasswordCredentials(USER, PASS.toCharArray()));
+        final HttpClientContext ctx = HttpClientContext.create();
+
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("realm", REALM)),
+                ctx);
+        assertTrue(scheme.isResponseReady(HOST, creds, ctx));
+
+        final String authz1 = scheme.generateAuthResponse(HOST, null, ctx);
+        final String clientFirstBare = deb64s(splitHeader(authz1).get("data")).substring("n,,".length());
+        final String clientNonce = parseCsvAttrs(clientFirstBare).get("r");
+
+        final String serverFirst = "r=" + clientNonce + "Z,s=" + b64("salt".getBytes(StandardCharsets.UTF_8)) + ",i=4096";
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("data", b64(serverFirst.getBytes(StandardCharsets.UTF_8)))),
+                ctx);
+
+        // client-final
+        scheme.generateAuthResponse(HOST, null, ctx);
+
+        // Final response carries data but no server signature 'v' -> must fail, not succeed.
+        final AuthenticationException ex = assertThrows(AuthenticationException.class, () ->
+                scheme.processChallenge(HOST, false,
+                        new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                                new BasicNameValuePair("data", b64("foo=bar".getBytes(StandardCharsets.UTF_8)))),
+                        ctx));
+        assertTrue(ex.getMessage().toLowerCase(Locale.ROOT).contains("signature"));
+        assertTrue(scheme.isChallengeComplete());
+    }
+
+    @Test
+    void strictScram_finalResponse_noAuthInfo_fails() throws Exception {
+        // A final response with no Authentication-Info at all (null challenge) must not be
+        // accepted as a successful mutual authentication once client-final has been sent.
+        final ScramScheme scheme = new ScramScheme();
+        final BasicCredentialsProvider creds = new BasicCredentialsProvider();
+        creds.setCredentials(new AuthScope(HOST, REALM, scheme.getName()),
+                new UsernamePasswordCredentials(USER, PASS.toCharArray()));
+        final HttpClientContext ctx = HttpClientContext.create();
+
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("realm", REALM)),
+                ctx);
+        assertTrue(scheme.isResponseReady(HOST, creds, ctx));
+
+        final String authz1 = scheme.generateAuthResponse(HOST, null, ctx);
+        final String clientFirstBare = deb64s(splitHeader(authz1).get("data")).substring("n,,".length());
+        final String clientNonce = parseCsvAttrs(clientFirstBare).get("r");
+
+        final String serverFirst = "r=" + clientNonce + "Z,s=" + b64("salt".getBytes(StandardCharsets.UTF_8)) + ",i=4096";
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("data", b64(serverFirst.getBytes(StandardCharsets.UTF_8)))),
+                ctx);
+
+        // client-final
+        scheme.generateAuthResponse(HOST, null, ctx);
+
+        // No Authentication-Info challenge on the final response -> must fail closed.
+        assertThrows(AuthenticationException.class, () ->
+                scheme.processChallenge(HOST, false, null, ctx));
+        assertTrue(scheme.isChallengeComplete());
+    }
+
     @Test
     void strictScram_authInfo_errorE_fails() throws Exception {
         final ScramScheme scheme = new ScramScheme();

diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/AuthenticationHandler.java b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/AuthenticationHandler.java
index acf51da..698936d 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/AuthenticationHandler.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/AuthenticationHandler.java
@@ -55,6 +55,7 @@
 import org.apache.hc.core5.http.ParseException;
 import org.apache.hc.core5.http.message.BasicHeader;
 import org.apache.hc.core5.http.message.MessageSupport;
+import org.apache.hc.core5.http.message.ParserCursor;
 import org.apache.hc.core5.http.protocol.HttpContext;
 import org.apache.hc.core5.util.Asserts;
 import org.slf4j.Logger;
@@ -71,6 +72,8 @@
 public class AuthenticationHandler {
 
     private static final Logger LOG = LoggerFactory.getLogger(AuthenticationHandler.class);
+    private static final String AUTHENTICATION_INFO = "Authentication-Info";
+    private static final String PROXY_AUTHENTICATION_INFO = "Proxy-Authentication-Info";
 
     private final AuthChallengeParser parser;
 
@@ -190,6 +193,30 @@ public Map<String, AuthChallenge> extractChallengeMap(
         return challengeMap;
     }
 
+    private AuthChallenge extractAuthenticationInfo(
+            final ChallengeType challengeType,
+            final HttpResponse response,
+            final AuthScheme authScheme,
+            final HttpClientContext context) {
+        final Header header = response.getFirstHeader(
+                challengeType == ChallengeType.PROXY ? PROXY_AUTHENTICATION_INFO : AUTHENTICATION_INFO);
+        if (header == null) {
+            return null;
+        }
+        try {
+            return parser.parse(
+                    challengeType,
+                    authScheme.getName(),
+                    header.getValue(),
+                    new ParserCursor(0, header.getValue().length()));
+        } catch (final ParseException ex) {
+            if (LOG.isWarnEnabled()) {
+                LOG.warn("{} Malformed authentication info", context.getExchangeId());
+            }
+            return null;
+        }
+    }
+
     /**
      * Handles the response from the opposite endpoint and updates the {@link AuthExchange}
      * state based on the challenge presented in the response message using the given
@@ -217,7 +244,7 @@ public boolean handleResponse(
             final AuthExchange authExchange,
             final HttpContext context) throws AuthenticationException, MalformedChallengeException {
 
-    final HttpClientContext clientContext = HttpClientContext.cast(context);
+        final HttpClientContext clientContext = HttpClientContext.cast(context);
         final String exchangeId = clientContext.getExchangeId();
         final boolean challenged = checkChallenged(challengeType, response, clientContext);
         final boolean isChallengeExpected = isChallengeExpected(authExchange);
@@ -257,8 +284,9 @@ public boolean handleResponse(
                 // AuthScheme is only set if we have already sent an auth response, either
                 // because we have received a challenge for it, or preemptively.
                 if (authScheme != null) {
-                    final String schemeName = authScheme.getName();
-                    final AuthChallenge challenge = challengeMap.get(schemeName.toLowerCase(Locale.ROOT));
+                    final AuthChallenge challenge = challenged
+                            ? challengeMap.get(authScheme.getName().toLowerCase(Locale.ROOT))
+                            : extractAuthenticationInfo(challengeType, response, authScheme, clientContext);
                     if (challenge != null || isChallengeExpected) {
                         if (LOG.isDebugEnabled()) {
                             LOG.debug("{} Processing authentication challenge {}", exchangeId, challenge);
@@ -275,6 +303,12 @@ public boolean handleResponse(
                                 throw ex;
                             }
                         }
+                        if (!challenged) {
+                            // There are no more challanges sent after the 200 message,
+                            // and if we get here, then the mutual auth phase has succeeded.
+                            authExchange.setState(AuthExchange.State.SUCCESS);
+                            return false;
+                        }
                         if (authScheme.isChallengeComplete()) {
                             if (LOG.isDebugEnabled()) {
                                 LOG.debug("{} Authentication failed", exchangeId);
@@ -283,14 +317,7 @@ public boolean handleResponse(
                             authExchange.setState(AuthExchange.State.FAILURE);
                             return false;
                         }
-                        if (!challenged) {
-                            // There are no more challanges sent after the 200 message,
-                            // and if we get here, then the mutual auth phase has succeeded.
-                            authExchange.setState(AuthExchange.State.SUCCESS);
-                            return false;
-                        } else {
-                            authExchange.setState(AuthExchange.State.HANDSHAKE);
-                        }
+                        authExchange.setState(AuthExchange.State.HANDSHAKE);
                         return true;
                     }
                     authExchange.reset();
diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
index 1c1224d..2ad112b 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/ScramScheme.java
@@ -207,7 +207,11 @@ public void processChallenge(
 
         if (authChallenge == null) {
             if (!challenged) {
-                // Final response with no Authentication-Info: nothing to do
+                if (this.state == State.CLIENT_FINAL_SENT || this.expectedV != null) {
+                    this.state = State.FAILED;
+                    zeroAndClearExpectedV();
+                    throw new AuthenticationException("SCRAM server final message missing");
+                }
                 return;
             }
             throw new MalformedChallengeException("Null SCRAM challenge");
@@ -224,6 +228,10 @@ public void processChallenge(
 
             final String data = params.get("data");
             if (data == null) {
+                if (this.state != State.INIT) {
+                    this.state = State.FAILED;
+                    throw new AuthenticationException("SCRAM state out of sequence: " + this.state);
+                }
                 // initial announce (no data)
                 this.realm = params.get("realm");
                 this.state = State.ANNOUNCED;
@@ -233,6 +241,10 @@ public void processChallenge(
             }
 
             // server-first (data present)
+            if (this.state != State.CLIENT_FIRST_SENT) {
+                this.state = State.FAILED;
+                throw new AuthenticationException("SCRAM state out of sequence: " + this.state);
+            }
             final String decoded = b64ToString(data);
             this.serverFirstRaw = decoded;
             final Map<String, String> attrs = parseAttrs(decoded);
@@ -289,8 +301,17 @@ public void processChallenge(
         // For Authentication-Info, RFC 7804 does NOT mandate a scheme token; do NOT enforce scheme name here.
         final String data = params.get("data");
         if (data == null) {
+            if (this.state == State.CLIENT_FINAL_SENT || this.expectedV != null) {
+                this.state = State.FAILED;
+                zeroAndClearExpectedV();
+                throw new AuthenticationException("SCRAM server final message missing");
+            }
             return;
         }
+        if (this.state != State.CLIENT_FINAL_SENT) {
+            this.state = State.FAILED;
+            throw new AuthenticationException("SCRAM state out of sequence: " + this.state);
+        }
         final String decoded = b64ToString(data);
         final Map<String, String> attrs = parseAttrs(decoded);
         final String err = attrs.get("e");
@@ -303,7 +324,9 @@ public void processChallenge(
         }
         final String vB64 = attrs.get("v");
         if (vB64 == null) {
-            return;
+            this.state = State.FAILED;
+            zeroAndClearExpectedV();
+            throw new AuthenticationException("SCRAM server final signature missing");
         }
 
         // compare 'v' in constant time; treat bad base64 for v as a signature mismatch (tests expect "signature")
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestAuthenticationHandler.java b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestAuthenticationHandler.java
index 272342b..a3ca360 100644
--- a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestAuthenticationHandler.java
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestAuthenticationHandler.java
@@ -215,6 +215,35 @@ void testAuthenticationNoChallenges() throws AuthenticationException, MalformedC
                 host, ChallengeType.TARGET, response, authStrategy, this.authExchange, this.context));
     }
 
+    @Test
+    void testAuthenticationInfoProcessedForChallengeExpectedScheme() throws Exception {
+        final HttpHost host = new HttpHost("somehost", 80);
+        final HttpResponse response = new BasicHttpResponse(HttpStatus.SC_OK, "OK");
+        response.addHeader(new BasicHeader("Authentication-Info", "data=\"abc\""));
+        final AuthScheme authScheme = Mockito.mock(AuthScheme.class);
+        Mockito.when(authScheme.getName()).thenReturn(StandardAuthScheme.SCRAM_SHA_256);
+        Mockito.when(authScheme.isChallengeExpected()).thenReturn(Boolean.TRUE);
+        Mockito.when(authScheme.isChallengeComplete()).thenReturn(Boolean.TRUE);
+        this.authExchange.setState(AuthExchange.State.HANDSHAKE);
+        this.authExchange.select(authScheme);
+
+        final DefaultAuthenticationStrategy authStrategy = new DefaultAuthenticationStrategy();
+
+        Assertions.assertFalse(this.httpAuthenticator.handleResponse(
+                host, ChallengeType.TARGET, response, authStrategy, this.authExchange, this.context));
+        Mockito.verify(authScheme).processChallenge(
+                Mockito.eq(host),
+                Mockito.eq(false),
+                Mockito.argThat(challenge -> challenge != null
+                        && StandardAuthScheme.SCRAM_SHA_256.equals(challenge.getSchemeName())
+                        && challenge.getParams() != null
+                        && challenge.getParams().size() == 1
+                        && "data".equals(challenge.getParams().get(0).getName())
+                        && "abc".equals(challenge.getParams().get(0).getValue())),
+                Mockito.eq(this.context));
+        Assertions.assertEquals(AuthExchange.State.SUCCESS, this.authExchange.getState());
+    }
+
     @Test
     void testAuthenticationNoSupportedChallenges() throws AuthenticationException, MalformedChallengeException {
         final HttpHost host = new HttpHost("somehost", 80);
diff --git a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
index ae383e5..801a5cd 100644
--- a/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
+++ b/httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestScramScheme.java
@@ -370,6 +370,69 @@ void strictScram_authInfo_errorE_fails() throws Exception {
         assertTrue(ex.getMessage().contains("server error"));
     }
 
+    @Test
+    void strictScram_missingAuthInfoAfterClientFinal_fails() throws Exception {
+        final ScramScheme scheme = new ScramScheme();
+        final BasicCredentialsProvider creds = new BasicCredentialsProvider();
+        creds.setCredentials(new AuthScope(HOST, REALM, scheme.getName()),
+                new UsernamePasswordCredentials(USER, PASS.toCharArray()));
+        final HttpClientContext ctx = HttpClientContext.create();
+
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("realm", REALM)),
+                ctx);
+        assertTrue(scheme.isResponseReady(HOST, creds, ctx));
+
+        final String authz1 = scheme.generateAuthResponse(HOST, null, ctx);
+        final String clientFirstBare = deb64s(splitHeader(authz1).get("data")).substring("n,,".length());
+        final String clientNonce = parseCsvAttrs(clientFirstBare).get("r");
+
+        final String serverFirst = "r=" + clientNonce + "Z,s=" + b64("salt".getBytes(StandardCharsets.UTF_8)) + ",i=4096";
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("data", b64(serverFirst.getBytes(StandardCharsets.UTF_8)))),
+                ctx);
+        scheme.generateAuthResponse(HOST, null, ctx);
+
+        final AuthenticationException ex = assertThrows(AuthenticationException.class, () ->
+                scheme.processChallenge(HOST, false, null, ctx));
+        assertTrue(ex.getMessage().toLowerCase(Locale.ROOT).contains("final"));
+    }
+
+    @Test
+    void strictScram_authInfoWithoutSignatureAfterClientFinal_fails() throws Exception {
+        final ScramScheme scheme = new ScramScheme();
+        final BasicCredentialsProvider creds = new BasicCredentialsProvider();
+        creds.setCredentials(new AuthScope(HOST, REALM, scheme.getName()),
+                new UsernamePasswordCredentials(USER, PASS.toCharArray()));
+        final HttpClientContext ctx = HttpClientContext.create();
+
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("realm", REALM)),
+                ctx);
+        assertTrue(scheme.isResponseReady(HOST, creds, ctx));
+
+        final String authz1 = scheme.generateAuthResponse(HOST, null, ctx);
+        final String clientFirstBare = deb64s(splitHeader(authz1).get("data")).substring("n,,".length());
+        final String clientNonce = parseCsvAttrs(clientFirstBare).get("r");
+
+        final String serverFirst = "r=" + clientNonce + "Z,s=" + b64("salt".getBytes(StandardCharsets.UTF_8)) + ",i=4096";
+        scheme.processChallenge(HOST, true,
+                new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                        new BasicNameValuePair("data", b64(serverFirst.getBytes(StandardCharsets.UTF_8)))),
+                ctx);
+        scheme.generateAuthResponse(HOST, null, ctx);
+
+        final AuthenticationException ex = assertThrows(AuthenticationException.class, () ->
+                scheme.processChallenge(HOST, false,
+                        new AuthChallenge(ChallengeType.TARGET, scheme.getName(),
+                                new BasicNameValuePair("data", b64("x=ignored".getBytes(StandardCharsets.UTF_8)))),
+                        ctx));
+        assertTrue(ex.getMessage().toLowerCase(Locale.ROOT).contains("signature"));
+    }
+
     @Test
     void strictScram_badBase64In401Data_isMalformed() {
         final ScramScheme scheme = new ScramScheme();

diff --git a/jupyter_server/nbconvert/handlers.py b/jupyter_server/nbconvert/handlers.py
index 5b12d70..474a4c5 100644
--- a/jupyter_server/nbconvert/handlers.py
+++ b/jupyter_server/nbconvert/handlers.py
@@ -92,6 +92,13 @@ class NbconvertFileHandler(JupyterHandler):
     auth_resource = AUTH_RESOURCE
     SUPPORTED_METHODS = ("GET",)
 
+    @property
+    def content_security_policy(self):
+        # nbconvert can produce HTML (e.g. the html exporter) from
+        # user-controlled notebook content. Confine any Javascript to a unique
+        # origin so it can't interact with the Jupyter server.
+        return super().content_security_policy + "; sandbox allow-scripts"
+
     @web.authenticated
     @authorized
     async def get(self, format, path):
@@ -173,6 +180,13 @@ class NbconvertPostHandler(JupyterHandler):
     SUPPORTED_METHODS = ("POST",)
     auth_resource = AUTH_RESOURCE
 
+    @property
+    def content_security_policy(self):
+        # nbconvert can produce HTML (e.g. the html exporter) from
+        # user-controlled notebook content. Confine any Javascript to a unique
+        # origin so it can't interact with the Jupyter server.
+        return super().content_security_policy + "; sandbox allow-scripts"
+
     @web.authenticated
     @authorized
     async def post(self, format):

diff --git a/jupyter_server/nbconvert/handlers.py b/jupyter_server/nbconvert/handlers.py
index 5b12d70..b562fb6 100644
--- a/jupyter_server/nbconvert/handlers.py
+++ b/jupyter_server/nbconvert/handlers.py
@@ -86,7 +86,19 @@ def get_exporter(format, **kwargs):
         raise web.HTTPError(500, "Could not construct Exporter: %s" % e) from e
 
 
-class NbconvertFileHandler(JupyterHandler):
+class NbconvertBaseHandler(JupyterHandler):
+    """Base handler for nbconvert responses."""
+
+    @property
+    def content_security_policy(self) -> str:
+        # nbconvert may render user-authored HTML. Keep any scripts it contains
+        # confined to a unique origin without access to the Jupyter server.
+        if self.settings.get("nbconvert_csp_sandbox", True):
+            return super().content_security_policy + "; sandbox allow-scripts"
+        return super().content_security_policy
+
+
+class NbconvertFileHandler(NbconvertBaseHandler):
     """An nbconvert file handler."""
 
     auth_resource = AUTH_RESOURCE
@@ -167,7 +179,7 @@ class NbconvertFileHandler(JupyterHandler):
         self.finish(output)
 
 
-class NbconvertPostHandler(JupyterHandler):
+class NbconvertPostHandler(NbconvertBaseHandler):
     """An nbconvert post handler."""
 
     SUPPORTED_METHODS = ("POST",)
diff --git a/jupyter_server/serverapp.py b/jupyter_server/serverapp.py
index a95e50e..32a9a31 100644
--- a/jupyter_server/serverapp.py
+++ b/jupyter_server/serverapp.py
@@ -457,6 +457,7 @@ class ServerWebApplication(web.Application):
             "websocket_ping_timeout": websocket_ping_timeout,
             # handlers
             "extra_services": extra_services,
+            "nbconvert_csp_sandbox": jupyter_app.nbconvert_csp_sandbox,
             # Jupyter stuff
             "started": now,
             # place for extensions to register activity
@@ -1604,6 +1605,16 @@ class ServerApp(JupyterApp):
         help="""If True, display controls to shut down the Jupyter server, such as menu items or buttons.""",
     )
 
+    nbconvert_csp_sandbox = Bool(
+        True,
+        config=True,
+        help=_i18n(
+            "If True, add a 'sandbox' directive to the Content-Security-Policy header "
+            "for nbconvert-served pages, confining any JavaScript to a unique origin "
+            "so it cannot interact with the Jupyter server."
+        ),
+    )
+
     contents_manager_class = Type(
         default_value=AsyncLargeFileManager,
         klass=ContentsManager,
diff --git a/tests/nbconvert/test_handlers.py b/tests/nbconvert/test_handlers.py
index b0d7da3..08387b3 100644
--- a/tests/nbconvert/test_handlers.py
+++ b/tests/nbconvert/test_handlers.py
@@ -7,6 +7,8 @@ from nbformat import writes
 from nbformat.v4 import new_code_cell, new_markdown_cell, new_notebook, new_output
 from tornado.httpclient import HTTPClientError
 
+from jupyter_server.utils import url_path_join
+
 from ..utils import expected_http_error
 
 png_green_pixel = encodebytes(
@@ -83,6 +85,35 @@ async def test_from_file(jp_fetch, notebook):
     assert "print(2*6)" in r.body.decode()
 
 
+@pytest.mark.parametrize(
+    "jp_server_config,expected",
+    [
+        ({"ServerApp": {"nbconvert_csp_sandbox": True}}, "sandbox allow-scripts"),
+        ({"ServerApp": {"nbconvert_csp_sandbox": False}}, None),
+    ],
+)
+async def test_from_file_sets_sandbox_csp(
+    jp_fetch, jp_base_url, jp_server_config, notebook, expected
+):
+    r = await jp_fetch(
+        "nbconvert",
+        "html",
+        "foo",
+        "testnb.ipynb",
+        method="GET",
+    )
+
+    report_uri = url_path_join(jp_base_url, "/api/security/csp-report")
+    base_csp = "; ".join(
+        ["frame-ancestors 'self'", "report-uri " + report_uri, "sandbox allow-scripts"]
+    )
+    csp = r.headers["Content-Security-Policy"]
+    if expected:
+        assert csp == base_csp
+    else:
+        assert "sandbox" not in csp
+
+
 async def test_from_file_404(jp_fetch, notebook):
     with pytest.raises(HTTPClientError) as e:
         await jp_fetch(
@@ -142,6 +173,35 @@ async def test_from_post(jp_fetch, notebook):
     assert "print(2*6)" in r.body.decode()
 
 
+@pytest.mark.parametrize(
+    "jp_server_config,expected",
+    [
+        ({"ServerApp": {"nbconvert_csp_sandbox": True}}, "sandbox allow-scripts"),
+        ({"ServerApp": {"nbconvert_csp_sandbox": False}}, None),
+    ],
+)
+async def test_from_post_sets_sandbox_csp(
+    jp_fetch, jp_base_url, jp_server_config, notebook, expected
+):
+    r = await jp_fetch(
+        "api/contents/foo/testnb.ipynb",
+        method="GET",
+    )
+    nbmodel = json.loads(r.body.decode())
+
+    r = await jp_fetch("nbconvert", "html", method="POST", body=json.dumps(nbmodel))
+
+    report_uri = url_path_join(jp_base_url, "/api/security/csp-report")
+    base_csp = "; ".join(
+        ["frame-ancestors 'self'", "report-uri " + report_uri, "sandbox allow-scripts"]
+    )
+    csp = r.headers["Content-Security-Policy"]
+    if expected:
+        assert csp == base_csp
+    else:
+        assert "sandbox" not in csp
+
+
 async def test_from_file_sanitize_html(jp_fetch, notebook):
     # flag explicitly set to true
     r = await jp_fetch(