CVE-2026-23552

23.02.2026, 09:17

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-346 - Origin Validation Error
The software does not properly verify that the source of data or communication is valid.

Vulnerability Media Exposure

[GERMAN] Apache Camel: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.
Published: 2026-02-17T23:00:00+00:00

References

https://camel.apache.org/security/CVE-2026-23552.html

https://github.com/oscerd/CVE-2026-23552

http://www.openwall.com/lists/oss-security/2026/02/18/7