Sensitive Information Exposure in Apache Camel OAuth Component

CVE-2026-94386

What is CVE-2026-94386?

The Apache Camel OAuth component experiences a vulnerability due to improper caching of OAuth 2.0 bearer tokens. The OAuthClientCredentialsTokenResolver stores tokens in a static cache, which is accessed by multiple instances and components. This design flaw allows different OAuth profiles, when sharing the same token endpoint and client ID, to inadvertently use each other's tokens. Profiles that request tokens under varying scopes or client secrets may retrieve a token that is broader or for a different service than intended. The system defaults to caching tokens, posing risks in misconfigured deployments, potentially leading to unauthorized access. To mitigate the risk, users should upgrade to version 4.23.0 or ensure token caching is disabled for profiles that share critical configurations.

References