Not rated
CVE-2026-23552 Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak…
Description
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Camel 4.15 | 4.15.0 → < 4.18.0 | 4.18.0 |
Other CVEs of Apache Camel
The 97 CVEs of Apache Camel →
CVE-2026-71569
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component
4.8
Medium
CVE-2026-90885
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component
7.5
High
CVE-2026-94386
Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component
4.8
Medium
CVE-2026-95628
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling…
5.4
Medium