CVE-2026-23552: apache software foundation apache camel Origin Validation Error
Vulnerability summary
CVE-2026-23552 is a critical (CVSS 9.1) Origin Validation Error vulnerability in apache software foundation apache camel. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-02-2026PublishedVulnerability first disclosed.
- 23-02-2026Last modifiedVulnerability information updated.
Description
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.17 pp
From 0.43% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCve 2026 23552
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Apache1 product
- camel≥ 4.15.0, < 4.18.0
Apache software foundation1 product
- apache camel≥ 4.15.0, < 4.18.0
Org.apache.camel1 product
- camel-keycloak≥ 4.15.0, < 4.18.0
3 vendors · 3 products
References
7 links
- github.com/apache/camelPACKAGE