Information Disclosure Flaw in Apache Camel HTTP Component

CVE-2026-85317

What is CVE-2026-85317?

The vulnerability in the Apache Camel HTTP component relates to the global OAuth2 client token cache in the JVM. It allows multiple endpoints differing only in their scope, resource indicator, or token endpoint to share the same cache entry. This can lead to unauthorized request authority, as tokens meant for different scopes or resources could be presented or utilized inappropriately. To mitigate this issue, users are advised to upgrade to Apache Camel 4.23.0 or later, where the cache key now incorporates all necessary fields, preventing the sharing of entries across endpoints. For those unable to upgrade immediately, consider running varying OAuth2 endpoints in separate JVMs.

References