Is CVE-2026-85301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85301 being exploited in the wild.

How severe is CVE-2026-85301?

Medium severity, with a CVSS score of 4.8, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.15.0 before 4.18.5, 4.19.0 before 4.22.1.

How is CVE-2026-85301 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85301?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85301: Apache Camel Keycloak issuer validation bypass

CVE-2026-85301 · Severity: medium · CVSS 4.8 · Published 2026-10-19

Apache Camel is an open-source integration framework used to route and transform messages between systems. The Keycloak component, which handles secure authentication against an identity provider, fails to properly validate token issuers when the introspection response omits a required claim. An attacker with access to a misconfigured Keycloak introspection endpoint could forge authentication tokens and impersonate legitimate users.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85301 being exploited in the wild.
How severe is CVE-2026-85301?: Medium severity, with a CVSS score of 4.8, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.15.0 before 4.18.5, 4.19.0 before 4.22.1.
Is there a fix for CVE-2026-85301?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: For deployments unable to upgrade immediately, ensure the configured Keycloak introspection endpoint returns the iss claim in its response and serves exactly one issuer. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85301 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85301?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

For deployments unable to upgrade immediately, ensure the configured Keycloak introspection endpoint returns the iss claim in its response and serves exactly one issuer.

Technical details

The vulnerability is an improper authentication flaw in Apache Camel's Keycloak security processor. When validating introspected tokens, the processor only checks the issuer claim (iss) if it is present in the introspection response; if absent, the check is skipped rather than rejected. This allows tokens from unintended issuers to be accepted when using a non-standard introspection endpoint that omits the iss claim and services multiple issuers. Exploitation requires both a misconfigured introspection endpoint and a malicious token, and is now treated as a validation failure in patched versions.

Affected products

Apache Camel 4.15.0 before 4.18.5, 4.19.0 before 4.22.1

Timeline

2026-10-15: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.