CVE-2026-23552

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23552", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-14T12:27:42.250Z", "datePublished": "2026-02-23T08:45:36.154Z", "dateUpdated": "2026-02-23T15:40:59.201Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.camel:camel-keycloak", "product": "Apache Camel", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.18.0", "status": "affected", "version": "4.15.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Andrea Cosentino"}, {"lang": "en", "type": "remediation developer", "value": "Andrea Cosentino"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.&nbsp;</p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.</span></span><br><p>This issue affects Apache Camel: from 4.15.0 before 4.18.0.</p><p>Users are recommended to upgrade to version 4.18.0, which fixes the issue.</p>"}], "value": "Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.\u00a0\n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "description": "CWE-346 Origin Validation Error", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-02-23T08:45:36.154Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://camel.apache.org/security/CVE-2026-23552.html"}, {"tags": ["exploit"], "url": "https://github.com/oscerd/CVE-2026-23552"}], "source": {"defect": ["CAMEL-22854"], "discovery": "INTERNAL"}, "title": "Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/18/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-23T09:21:26.298Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T15:38:52.061419Z", "id": "CVE-2026-23552", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T15:40:59.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/18/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-23T09:21:26.298Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23552", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T15:38:52.061419Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T15:39:06.733Z"}}], "cna": {"title": "Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy", "source": {"defect": ["CAMEL-22854"], "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Andrea Cosentino"}, {"lang": "en", "type": "remediation developer", "value": "Andrea Cosentino"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "versions": [{"status": "affected", "version": "4.15.0", "lessThan": "4.18.0", "versionType": "semver"}], "packageName": "org.apache.camel:camel-keycloak", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://camel.apache.org/security/CVE-2026-23552.html", "tags": ["vendor-advisory"]}, {"url": "https://github.com/oscerd/CVE-2026-23552", "tags": ["exploit"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.\u00a0\n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.&nbsp;</p><span style=\"background-color: rgb(255, 255, 255);\"><span style=\"background-color: rgb(255, 255, 255);\">The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.</span></span><br><p>This issue affects Apache Camel: from 4.15.0 before 4.18.0.</p><p>Users are recommended to upgrade to version 4.18.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-02-23T08:45:36.154Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23552", "state": "PUBLISHED", "dateUpdated": "2026-02-23T15:40:59.201Z", "dateReserved": "2026-01-14T12:27:42.250Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-02-23T08:45:36.154Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.camel:camel-keycloak", "product": "Apache Camel", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.18.0", "status": "affected", "version": "4.15.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E575766B-E717-45A6-BD34-2C004B8EA67F", "versionEndExcluding": "4.18.0", "versionStartIncluding": "4.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.\u00a0\n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue."}, {"lang": "es", "value": "Omisi\u00f3n de la aceptaci\u00f3n de tokens entre dominios (realms) en el componente KeycloakSecurityPolicy de Apache Camel Keycloak.\n\nLa pol\u00edtica de seguridad KeycloakSecurityPolicy de Camel-Keycloak no valida la declaraci\u00f3n 'iss' (emisor) de los tokens JWT contra el dominio (realm) configurado. Un token emitido por un dominio (realm) de Keycloak es aceptado silenciosamente por una pol\u00edtica configurada para un dominio (realm) completamente diferente, rompiendo el aislamiento de inquilinos.\nEste problema afecta a Apache Camel: desde la versi\u00f3n 4.15.0 hasta antes de la 4.18.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 4.18.0, que corrige el problema."}], "id": "CVE-2026-23552", "lastModified": "2026-06-17T10:21:46.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23552", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T15:38:52.061419Z", "version": "2.0.3"}}]}, "published": "2026-02-23T09:17:00.857", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://camel.apache.org/security/CVE-2026-23552.html"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/oscerd/CVE-2026-23552"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/18/7"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.15.0,4.18.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Camel", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "camel", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-18T11:06:05.024046+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Camel to version 4.18.0 or later, which includes issuer validation in the KeycloakSecurityPolicy.", "Verify that all Camel routes using KeycloakSecurityPolicy are configured to accept only tokens from the intended realm by checking the realm configuration and, if necessary, explicitly validating the iss claim in custom policies.", "Monitor application logs for unexpected token issuers and apply network segmentation to restrict access to the Camel application from untrusted networks."], "summary": {"action": "Patch", "impact": "Authorization Bypass via Cross-Realm Token Acceptance"}, "threat_synthesis": {"affected_systems": "Apache Camel versions from 4.15.0 up to, but not including, 4.18.0 contain the vulnerability. These releases deploy the KeycloakSecurityPolicy without issuer validation.", "description_and_impact": "Apache Camel\u2019s Camel-Keycloak KeycloakSecurityPolicy fails to verify the issuer claim of JSON Web Tokens. As a result, a token issued by one Keycloak realm can be accepted by a policy configured for a different realm, breaking tenant isolation and allowing an attacker to impersonate a user from another realm. This flaw corresponds to CWE-346, a failure to validate token authenticity, and can lead to unauthorized access to protected resources.", "risk_and_exploitability": "The CVSS score of 9.1 indicates a critical impact on confidentiality, integrity, and availability with a high exploitation complexity. The EPSS score is less than 1%, suggesting a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can send a crafted HTTP request bearing a malicious JWT from another realm to any Camel route that uses the KeycloakSecurityPolicy, gaining unauthorized access behind the tenancy isolation layer."}}}}, "created": "2026-02-23T14:28:03.287067+00:00", "updated": "2026-04-18T11:15:35.909193+00:00", "vendors": ["apache", "apache$PRODUCT$camel"]}