PT-2026-20652 · Red Hat+1 · Keycloak+1

Andrea Cosentino · Published 2026-02-19 · Updated 2026-02-28 · CVE-2026-23552

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.17.9

Description The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. This allows a token issued by one Keycloak realm to be silently accepted by a policy configured for a different realm, which breaks tenant isolation. The iss claim identifies the issuer of the JWT.

Recommendations Upgrade to version 4.18.0 to resolve this issue.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-23552

GHSA-C3F3-CC42-XR9V

Affected Products

Apache Camel

Keycloak

References · 19

• 🔥 https://github.com/oscerd/CVE-2026-23552 · Exploit
• https://camel.apache.org/security/CVE-2026-23552.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23552 · Security Note
• https://osv.dev/vulnerability/GHSA-c3f3-cc42-xr9v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23552 · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/commit/c1ed776e3a4fa23d15acf4b9a48fdf758d4316ff · Note
• https://twitter.com/VulmonFeeds/status/2025882432738570749 · Twitter Post
• https://issues.apache.org/jira/browse/CAMEL-22854 · Note
• https://twitter.com/the_yellow_fall/status/2024486646062739904 · Twitter Post
• https://t.me/cveNotify/152834 · Telegram Post
• https://twitter.com/cracbot/status/2027338062486024225 · Twitter Post
• https://t.me/CVEtracker/45484 · Telegram Post
• https://twitter.com/cracbot/status/2027700362963259734 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/18/7 · Note