CVE-2026-23552CRITICAL 9.1EPSS p31.5%

CVE-2026-23552CVE-2026-23552

Description

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component.  The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy configured for a completely different realm, breaking tenant isolation. This issue affects Apache Camel: from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.40% probability of exploitation · percentile 31.5% · 2026-06-19T12:03:05Z
Published2026-02-23
Last modified2026-02-26

Underlying weaknesses· 1

CWE-346

References

  1. https://camel.apache.org/security/CVE-2026-23552.html
  2. https://github.com/oscerd/CVE-2026-23552
  3. http://www.openwall.com/lists/oss-security/2026/02/18/7

1

TypeTargetConfidenceTier
WeaknessOrigin Validation Errorcwe-3460%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-8922
CVE
CVE-2026-1486
CVE
CVE-2026-45760
CVE
CVE-2026-2603
CVE
CVE-2026-9087
CVE
CVE-2026-7571
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.