Is CVE-2026-85317 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85317 being exploited in the wild.

How severe is CVE-2026-85317?

Medium severity, with a CVSS score of 4.8, published 19 October 2026.

Which products and versions are affected?

Apache Camel 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1.

How is CVE-2026-85317 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-85317?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85317: Apache Camel HTTP OAuth2 token cache information disclosure

CVE-2026-85317 · Severity: medium · CVSS 4.8 · Published 2026-10-19

Apache Camel is an integration framework that processes data across systems using OAuth2 authentication. A flaw in how Camel caches OAuth2 tokens could allow one endpoint to receive a token meant for another endpoint with different permissions or a different authorization server, potentially granting unintended access. This only affects deployments configuring multiple OAuth2 endpoints with differing scopes or token endpoints.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-85317 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85317 being exploited in the wild.
How severe is CVE-2026-85317?: Medium severity, with a CVSS score of 4.8, published 19 October 2026.
Which products and versions are affected?: Apache Camel 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1.
Is there a fix for CVE-2026-85317?: Yes: fixed in 4.18.5, 4.22.1, 4.23.0. Until then: For deployments unable to upgrade immediately, run endpoints that differ in scope, resource indicator, or token endpoint in separate JVMs so they do not share the cache. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85317 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-85317?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.18.5, 4.22.1, 4.23.0

For deployments unable to upgrade immediately, run endpoints that differ in scope, resource indicator, or token endpoint in separate JVMs so they do not share the cache.

Technical details

The OAuth2 client token cache is keyed on insufficient fields, omitting scope, resource indicator, and token endpoint; two endpoints differing only in these fields share a cached token. An attacker in a multi-endpoint deployment could be served a token minted for broader authority or issued by a different authorization server. The vulnerability requires a deployment with multiple OAuth2 endpoints configured to differ in scope, resource indicator, or token endpoint; network access is not required.

Affected products

Apache Camel 4.0.0 to before 4.18.5, 4.19.0 to before 4.22.1

Timeline

2026-10-15: disclosed
2026-10-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.