Paper/Archive/CVE-2026-23552

CVE-2026-23552

Apache Software Foundation Apache Camel — Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

EPSS 0.6%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 49.1.491 × 209.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Camel4.15.0 – < 4.18.04.18.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

advisorycamel.apache.org/security/CVE-2026-23552.html exploitgithub.com/oscerd/CVE-2026-23552 refopenwall.com/lists/oss-security/2026/02/18/7