CVE-2026-23552: Apache Camel Keycloak Component JWT Token Issuer Validation Bypass
Summary
CVE-2026-23552: Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm. Affects org.apache.camel:camel-keycloak versions >= 4.15.0, < 4.18.0. Fixed in 4.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that allows developers to integrate various applications using a wide range of protocols and data formats. The Camel-Keycloak component provides integration with Keycloak, an open-source identity and access management solution. This component is designed to secure applications by validating JSON Web Tokens (JWT) issued by Keycloak. However, a significant vulnerability exists in the KeycloakSecurityPolicy, which fails to validate the issuer of JWT tokens against the configured realm, potentially leading to tenant isolation breaches.
Vulnerability Detail
The vulnerability arises from the Camel-Keycloak KeycloakSecurityPolicy's inability to validate the 'iss' (issuer) claim of JWT tokens against the configured realm. This oversight allows tokens issued by one Keycloak realm to be accepted by a policy configured for a different realm without any validation. As a result, unauthorized access can occur, compromising the security and isolation of tenants within the application. This issue affects Apache Camel versions from 4.15.0 to before 4.18.0, and it is classified with a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Minimum fixed version
4.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the recommended update to the patched version of the package.
Conclusion
The vulnerability CVE-2026-23552 in the Apache Camel Keycloak component poses a significant risk by allowing JWT tokens from different realms to be accepted without validation. Users are strongly advised to upgrade to version 4.18.0 to mitigate this risk and ensure proper tenant isolation.
See every vulnerability recorded for org.apache.camel:camel-keycloak →
FAQ
The vulnerability allows JWT tokens from one Keycloak realm to be accepted by another realm, potentially leading to unauthorized access and breaking tenant isolation.
The affected versions are Apache Camel from 4.15.0 to before 4.18.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your 'pom.xml' file, you can identify if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
To upgrade, modify your Maven 'pom.xml' file to include the dependency for version 4.18.0 of the camel-keycloak package and rebuild your application.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-keycloak.
