What’s Vulnerable › Vulnerabilities

CVE-2026-23552: Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-23 · updated 2026-06-17
• Weakness: CWE-346

Description

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Camel: from 4.15.0 before 4.18.0 — fixed in 4.18.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Camel 4.18.0. Check the vendor advisory for mitigations.

References

• https://camel.apache.org/security/CVE-2026-23552.html
• https://github.com/oscerd/CVE-2026-23552
• http://www.openwall.com/lists/oss-security/2026/02/18/7

Get alerted when CVE-2026-23552 or the next vulnerability affects your stack