CVE-2026-23552: Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.camel:camel-keycloakto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
Apache Camel (camel-keycloak)to a version that resolves this vulnerability.Fixed in 4.18.0 - Compensating control
Restrict and/or segregate Keycloak realm usage and ensure tokens from one realm are not presented to Camel services/policies configured for other realms (until upgraded) to maintain tenant isolation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23552?
CVE-2026-23552 has a high severity due to the potential for cross-realm token acceptance bypass.
How do I fix CVE-2026-23552?
To fix CVE-2026-23552, ensure that the KeycloakSecurityPolicy validates the 'iss' claim of JWT tokens properly.
Which software versions are affected by CVE-2026-23552?
CVE-2026-23552 affects Apache Camel versions between 4.15.0 and 4.18.0.
What type of attack does CVE-2026-23552 enable?
CVE-2026-23552 enables attackers to bypass security policies for cross-realm token acceptance.
Is CVE-2026-23552 applicable to all Apache Camel deployments?
No, CVE-2026-23552 is specifically applicable to deployments using the Camel-Keycloak component.