Improper Authentication Issue in Apache Camel Keycloak Component

CVE-2026-85301

What is CVE-2026-85301?

An improper authentication vulnerability exists in the Keycloak component of Apache Camel, affecting versions prior to 4.23.0. This issue arises when the security processor validates the issuer of an introspected token only if the introspection response includes an 'iss' claim. If the claim is absent, the check is skipped, allowing a token not minted by the configured issuer to be erroneously accepted. Although this configuration is atypical and considered low risk, it poses a significant threat in deployments where the introspection endpoint may omit the 'iss' claim and accepts tokens from multiple issuers. To mitigate this vulnerability, upgrade to Apache Camel 4.23.0 or higher. For users on the 4.18.x LTS releases, version 4.18.5 should be installed, and for the 4.22.x LTS releases, upgrade to 4.22.1. Ensuring that the introspection endpoint returns an 'iss' claim is critical for those who cannot upgrade immediately.

References