CVE-2026-85301
Received Received - Intake

Improper Authentication in Apache Camel Keycloak Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim was absent the check was skipped rather than treated as a failure, so a token that the configured issuer did not mint could be accepted provided the introspection endpoint answered without naming an issuer. Reaching this requires an introspection endpoint that omits iss and accepts tokens from more than one issuer, which is not the default Keycloak arrangement, hence the low severity; where that arrangement exists the consequence is that the deployment authenticates a caller it should have rejected. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. An absent iss claim is now treated as a validation failure rather than as a reason to skip the check. For deployments that cannot upgrade immediately, ensure the introspection endpoint returns the iss claim, and that it serves exactly one issuer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85301
EUVD
EUVD-2026-104198

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.15.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Authentication issue in the Apache Camel Keycloak component. It occurs when the security processor fails to validate the issuer of an introspected token if the introspection response does not include an iss claim. Instead of rejecting the token, the check is skipped, allowing tokens from unauthorized issuers to be accepted.

Detection Guidance

Detecting this vulnerability requires checking Apache Camel versions and Keycloak introspection endpoint behavior. Verify if your Apache Camel version is between 4.15.0 and 4.18.4 or 4.19.0 and 4.22.0. Inspect Keycloak introspection responses for missing iss claims when tokens from multiple issuers are accepted.

Impact Analysis

This vulnerability could allow unauthorized access to systems or data if an attacker presents a token from an untrusted issuer. The impact is limited because it requires a specific introspection endpoint configuration that is not default in Keycloak.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 or 4.22.1). If immediate upgrade is not possible, ensure the Keycloak introspection endpoint returns the iss claim and serves only one issuer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart