{"id":"CVE-2026-23552","aliases":["EUVD-2026-7591","GHSA-c3f3-cc42-xr9v"],"status":"published","title":"Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00607,"percentile":0.49395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-346"],"published":"2026-02-23T08:45:36Z","modified":"2026-10-28T02:30:57Z","exploits":[{"source":"pocgithub","id":"oscerd/CVE-2026-23552","title":"oscerd/CVE-2026-23552","date":"2026-02-09","url":"https://github.com/oscerd/CVE-2026-23552"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.camel:camel-keycloak","fixed_in":["4.18.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.18.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.18.0"}]}],"versions":["4.15.0","4.16.0","4.17.0"]}],"products":[{"vendor":"apache","product":"camel"},{"vendor":"apache software foundation","product":"apache camel"}],"references":[{"url":"https://camel.apache.org/security/CVE-2026-23552.html","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/oscerd/CVE-2026-23552","tags":["exploit","Exploit","Third Party Advisory","evidence","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/02/18/7","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23552","tags":["advisory"]},{"url":"https://github.com/apache/camel/commit/c1ed776e3a4fa23d15acf4b9a48fdf758d4316ff","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-22854","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c3f3-cc42-xr9v"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23552.json","tags":["advisory"]},{"url":"https://github.com/apache/camel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-23552","title":"Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T08:45:36.154Z","modified":"2026-02-23T15:40:59.201Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-7591","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T08:45:36Z","modified":"2026-02-23T15:40:59Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:32.158773Z"}],"ghsa":[{"id":"GHSA-c3f3-cc42-xr9v","title":"Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T09:31:23Z","modified":"2026-02-25T18:04:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2026-23552","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T09:17:00.857Z","modified":"2026-06-17T10:21:46.04Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:12:06.63895Z"}],"osv":[{"id":"CVE-2026-23552","title":"Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T08:45:36.154Z","modified":"2026-10-28T02:30:57.657196669Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"GHSA-c3f3-cc42-xr9v","title":"Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm","description":"Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. \n\nThe Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.\nThis issue affects Apache Camel: from 4.15.0 before 4.18.0.\n\nUsers are recommended to upgrade to version 4.18.0, which fixes the issue.","status":"published","published":"2026-02-23T09:31:23Z","modified":"2026-02-25T19:56:25.472778Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}