Improper Authentication in Apache Camel - CVE-2026-85301
Published: October 23, 2026
Vulnerability identifier: #VU157310
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85301
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass issuer validation and authenticate using a token not issued by the configured issuer.
The vulnerability exists due to improper authentication in the Apache Camel Keycloak component's security processor when processing token introspection responses that omit the iss claim. A remote attacker can present a token minted by a different issuer to bypass the skipped issuer check and authenticate as a caller the deployment should reject.
Exploitation requires an introspection endpoint that accepts tokens from multiple issuers, which is not the default Keycloak arrangement.
Affected software
Apache Camel
How to mitigate CVE-2026-85301
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1