Critical severity · published Feb 23, 2026
CVE-2026-23552
Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.
The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation.
This issue affects Apache Camel: from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache Camel · Apache Software Foundation
4.15.0 before 4.18.0 · source: vendor
CA
Camel · Apache
4.15.0 before 4.18.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23552
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23552
Vendor Advisory
https://camel.apache.org/security/CVE-2026-23552.html
Exploit
https://github.com/oscerd/CVE-2026-23552
Mailing List
http://www.openwall.com/lists/oss-security/2026/02/18/7
More from Apache Camel
10.0
CVE-2026-78162
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
10.0
CVE-2026-33453
Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
9.8
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
9.8
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
9.8
CVE-2026-43867
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter