CVE-2026-23552 — Vulnerability in org.apache.camel:camel-keycloak...

CRITICAL

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Published February 23, 2026Updated February 25, 2026Source: osv

Summary

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Advisory Timeline

First published February 23, 2026 (231 days ago).
Last revised February 25, 2026 — 2 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.apache.camel:camel-keycloak to 4.18.0 or later

<!-- Update pom.xml dependency version to 4.18.0 for org.apache.camel:camel-keycloak -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

Package	Ecosystem	Affected	Fixed In
org.apache.camel:camel-keycloak	maven	4.15.0, 4.16.0, 4.17.0	4.18.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-346
Origin Validation ErrorMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-23552?: Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-23552?: CVE-2026-23552 affects org.apache.camel:camel-keycloak. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-23552 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-c3f3-cc42-xr9v

Related CVEs

CVE-2026-40453
CRITICAL
Apache Camel has an incomplete fix for CVE-2025-27636
CVE-2026-40860
CRITICAL
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
CVE-2026-46455
CRITICAL
Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
CVE-2026-53913
CRITICAL
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
CVE-2026-40859
HIGH
Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
CVE-2026-42527
HIGH
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
CVE-2026-43866
HIGH
Apache Camel JMS deserialization filter bypass
CVE-2026-46592
HIGH
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies