What is the CVSS score of CVE-2026-23552?

CVE-2026-23552 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Camel are affected by CVE-2026-23552?

A critical authentication bypass vulnerability in Apache Camel's Keycloak component allows attackers to forge valid authentication tokens from unauthorized realms, potentially granting unauthorized…. A patch is available.

Is there a public PoC exploit available for CVE-2026-23552?

Yes, a public proof-of-concept exploit is available for CVE-2026-23552. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23552?

Within 24 hours: Identify all systems using Apache Camel with Keycloak component and assess their exposure; isolate or disable affected services if business-critical. Within 7 days: Implement compensating controls (network segmentation, WAF rules validating issuer claims, enhanced monitoring); evaluate alternative authentication mechanisms. Within 30 days: Monitor Apache Camel security advisories for patch availability; conduct security audit of all token-based authentication flows; develop migration plan away from vulnerable component or upgrade to patched version when released.

Camel CVE-2026-23552

CRITICAL

Origin Validation Error (CWE-346)

2026-02-23 security@apache.org

GHSA-c3f3-cc42-xr9v

Apache Camel

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 26, 2026 - 16:46 vuln.today

Public exploit code

CVE Published

Feb 23, 2026 - 09:17 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.apache.camel:camel-keycloak (2 direct, 1 indirect)

Ecosystem-wide dependent count for version 4.15.0.

DescriptionCVE.org

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0.

Users are recommended to upgrade to version 4.18.0, which fixes the issue.

AnalysisAI

Cross-realm token acceptance bypass in Apache Camel Keycloak security policy. The KeycloakSecurityPolicy fails to properly validate token issuers, accepting tokens from different Keycloak realms. PoC available.

Technical ContextAI

CWE-346 origin validation error. The Camel Keycloak component accepts tokens from any Keycloak realm rather than restricting to the configured realm, enabling cross-tenant access.

RemediationAI

Update Apache Camel. Implement strict realm/issuer validation in security policies.

More in Camel

View all

CVE-2025-27636 MEDIUM This Month POC

5.6 Mar 09

Bypass/Injection vulnerability in Apache Camel components under particular conditions.10.0 through <= 4.10.1, from 4.8.0

CVE-2014-0002 HIGH Act Now POC

7.5 Mar 21

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary file

CVE-2016-8749 CRITICAL Act Now POC

9.8 Mar 28

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. Rated cri

CVE-2014-0003 HIGH Act Now POC

7.5 Mar 21

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remo

CVE-2026-25747 HIGH This Week POC

8.8 Feb 23

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSeria

CVE-2026-40473 HIGH This Week POC

8.8 Apr 27

Unsafe Java deserialization in the Apache Camel camel-mina component (versions 3.0.0 through 4.14.5, 4.15.0 through 4.18

CVE-2019-0194 HIGH This Week POC

7.5 Apr 30

Apache Camel's File is vulnerable to directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2017-12634 CRITICAL Act Now

9.8 Nov 15

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-se

CVE-2015-5344 CRITICAL Act Now

9.8 Feb 03

The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arb

CVE-2017-12633 CRITICAL Act Now

9.8 Nov 15

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-s

CVE-2013-4330 MEDIUM This Month

6.8 Oct 04

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arb

CVE-2017-3159 CRITICAL Act Now

9.8 Mar 07

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. Rated critical sev

Same weakness CWE-346 – Origin Validation Error

View all

CVE-2015-4495 HIGH POC

8.8

CVE-2025-34291 CRITICAL POC

9.4

CVE-2020-16952 HIGH POC

8.6

CVE-2022-50925 CRITICAL POC

9.8

CVE-2024-25124 CRITICAL POC

9.8

CVE-2023-29711 CRITICAL POC

9.8

CVE-2023-33443 CRITICAL POC

9.8

CVE-2023-29728 CRITICAL POC

9.8

CVE-2026-23552 vulnerability details – vuln.today

Back

Camel CVE-2026-23552

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Camel

Same weakness CWE-346 – Origin Validation Error

Share

External POC / Exploit Code