Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

緊急 9.1CVE-2026-23552 · GHSA-c3f3-cc42-xr9v · 23/02/2026 公開 · 17/06/2026 更新

要点

CVE-2026-23552 は org.apache.camel:camel-keycloak, camel (apache) に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.61%（全脆弱性の 49.1% より高い）。
対処：4.18.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.camel:camel-keycloak Maven	`≥ 4.15.0, < 4.18.0`	`4.18.0`
camel apache	`≥ 4.15.0, < 4.18.0`	`4.18.0`

概要

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.

NVD の説明

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.