CVE-2026-23552
published 2026-02-23CVE-2026-23552: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.40%
32.4th percentile
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | — | — |
| apache | camel | >= 4.15.0 < 4.18.0 | 4.18.0 |
| apache | camel | >= 4.15.0 < 4.18.3 | 4.18.3 |
| apache | camel | >= 4.19.0 < 4.21.0 | 4.21.0 |
| apache_software_foundation | apache_camel_keycloak | >= 4.15.0 < 4.18.3 | 4.18.3 |
| apache_software_foundation | apache_camel_keycloak | >= 4.19.0 < 4.21.0 | 4.21.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_apache9.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache camel: CVE-2026-23552
vendor_apache·CVSS 9.1
CVE-2026-23552 [HIGH] Apache camel: CVE-2026-23552
Apache camel: CVE-2026-23552
From 4.15.0 before 4.18.0. 4.18.0 HIGH Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance in KeycloakSecurityPolicy
Severity: high
GHSA
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.
ghsa_unreviewed·2026-07-06·CVSS 9.1
CVE-2026-53913 [CRITICAL] CWE-287 Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.
Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.
The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermi
GHSA
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
ghsa·2026-02-23
CVE-2026-23552 [CRITICAL] CWE-346 Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue.
OSV
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
osv·2026-02-23
CVE-2026-23552 [CRITICAL] Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-02-23
Published