Use of cache containing sensitive information in Apache Camel - CVE-2026-85317
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause requests to carry broader authority than configured or disclose OAuth2 tokens to unintended recipients.
The vulnerability exists due to incomplete cache key construction in the Apache Camel HTTP component's JVM-global OAuth2 client token cache when processing requests for endpoints with different OAuth2 settings. A remote attacker can trigger reuse of a cached token associated with a different scope, resource indicator, or token endpoint to cause requests to carry unintended authority or expose tokens to recipients they were not issued for.
Exploitation requires multiple OAuth2 endpoints in the same JVM whose token configurations differ only in the requested scope, resource indicator, or token endpoint.