CRITICAL🇵🇱 Wersja polska

CVE-2026-23552

CVSS 9.1v3.1pub. 2026-02-23upd. 2026-02-26

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Apache Camel

    APP
    Apache
    4.15.0 – 4.18.0 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-47323CRITICAL9.8PL ✓ten sam produkt

Apache Camel: wstrzyknięcie nagłówków HTTP w camel-cxf i camel-knative (RCE)

CVE-2026-40860CRITICAL9.8PL ✓ten sam produkt

Apache Camel: niebezpieczna deserializacja JMS ObjectMessage prowadząca do RCE

CVE-2026-33453CRITICAL10.0PL ✓ten sam produkt

Apache Camel camel-coap: RCE poprzez wstrzyknięcie nagłówków Camel

CVE-2026-33454CRITICAL9.4PL ✓ten sam produkt

Apache Camel: wstrzyknięcie nagłówków przez komponent Camel-Mail

CVE-2026-40453CRITICAL9.9PL ✓ten sam produkt

Apache Camel — obejście filtrowania nagłówków umożliwiające RCE