Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

NGHIÊM TRỌNG 9.1CVE-2026-23552 · GHSA-c3f3-cc42-xr9v · Công bố 23/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-23552 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.1) ảnh hưởng org.apache.camel:camel-keycloak, camel (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.61%, cao hơn 49.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.18.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.camel:camel-keycloak Maven	`≥ 4.15.0, < 4.18.0`	`4.18.0`
camel apache	`≥ 4.15.0, < 4.18.0`	`4.18.0`

Mô tả

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Mô tả của NVD

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.