CVE-2026-23552
📋 TL;DR
The CVE-2026-23552 vulnerability allows attackers to bypass tenant isolation in Apache Camel Keycloak component by using JWT tokens from unauthorized Keycloak realms. This affects Apache Camel users running versions 4.15.0 through 4.17.0 who use the KeycloakSecurityPolicy for authentication.
💻 Affected Systems
- Apache Camel
📦 What is this software?
Camel by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete tenant isolation failure allowing unauthorized access to protected resources across different realms, potentially leading to data leakage or privilege escalation.
Likely Case
Unauthorized access to resources intended for different tenants in multi-tenant deployments, compromising data segregation.
If Mitigated
Limited impact with proper network segmentation and additional authorization checks beyond JWT validation.
🎯 Exploit Status
Exploitation requires obtaining a JWT token, but doesn't require token forgery - any valid token from any realm will be accepted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.18.0
Vendor Advisory: https://camel.apache.org/security/CVE-2026-23552.html
Restart Required: Yes
Instructions:
1. Upgrade Apache Camel to version 4.18.0 or later. 2. Update Maven/Gradle dependencies to use camel-keycloak:4.18.0+. 3. Restart all Camel applications using the KeycloakSecurityPolicy.
🔧 Temporary Workarounds
Custom JWT Validator
allImplement custom JWT validation that checks the 'iss' claim matches the expected realm.
Implement custom processor to validate JWT issuer before KeycloakSecurityPolicy
Network Segmentation
allIsolate different tenant environments at network level to prevent cross-realm token usage.
🧯 If You Can't Patch
- Implement additional authorization checks after JWT validation to verify tenant context
- Use API gateway with proper JWT validation before requests reach Camel applications
🔍 How to Verify
Check if Vulnerable:
Check if using Apache Camel 4.15.0-4.17.0 with camel-keycloak dependency and KeycloakSecurityPolicy in routes.Check Version:
mvn dependency:tree | grep camel-keycloak OR check CamelContext version in application logsVerify Fix Applied:
After upgrade, test with JWT tokens from unauthorized realms - they should be rejected with proper issuer validation.📡 Detection & Monitoring
Log Indicators:
- Authentication failures for valid tokens
- Unexpected realm names in JWT validation logs
- Access patterns crossing tenant boundaries
Network Indicators:
- Requests with JWT tokens containing unexpected 'iss' claims
- Authentication requests to wrong realm endpoints
SIEM Query:
source="camel-logs" AND (message="*KeycloakSecurityPolicy*" AND NOT message="*issuer validation*" AND message="*authentication successful*")