CVE-2026-85317
Received Received - Intake

Cache Key Flaw in Apache Camel OAuth2 Client Token

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually authorises: the requested scope, the resource indicator, and the token endpoint the token was obtained from. Two endpoints differing only in those fields therefore shared a cache entry, and an endpoint could be served a token minted for a different scope, a different resource, or by a different authorization server. The consequence is a request carrying broader authority than the endpoint was configured for, or a token presented to a party it was not issued for. Reaching it requires a deployment that configures more than one OAuth2 endpoint differing in exactly those fields, which is why the severity is assessed low. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The cache key now includes every field that shapes the token, so entries are no longer shared between endpoints that differ in any of them. For deployments that cannot upgrade immediately, run endpoints that differ in scope, resource indicator or token endpoint in separate JVMs so that they do not share the cache.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85317
EUVD
EUVD-2026-104205

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-524 The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85317 is a vulnerability in Apache Camel's HTTP component where the OAuth2 token cache uses an incomplete key. The cache omits critical fields like requested scope, resource indicator, and token endpoint, causing tokens intended for one endpoint to be reused by another differing only in those fields. This grants broader authority than configured or exposes tokens to unintended recipients.

Detection Guidance

Detecting this vulnerability requires checking Apache Camel versions and OAuth2 token cache configurations. Verify installed Camel versions with commands like 'camel --version' or 'mvn dependency:tree | grep camel-core'. Inspect JVM-wide token cache usage in logs or monitoring tools for shared tokens across endpoints with different scopes or resource indicators.

Impact Analysis

This vulnerability could allow a route with narrow permissions to receive a token with broader scope cached by another route. Tokens may be exposed to unintended parties or used outside their intended scope. In multi-context JVMs, tokens from one context could be reused by another, undermining access control and creating misleading audit trails.

Mitigation Strategies

Upgrade Apache Camel to 4.23.0 or apply LTS patches (4.18.5 for 4.18.x, 4.22.1 for 4.22.x). As a temporary workaround, run endpoints with differing scopes or resource indicators in separate JVMs to prevent cache sharing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart