# CVE-2026-94386: Apache Camel OAuth component cache containing sensitive information

Source: https://junglewise.ai/threats/cve-2026-94386-use-of-cache-containing-sensitive-information-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-94386 · Severity: medium · CVSS 4.8 · Published 2026-10-26

Apache Camel's OAuth token resolver caches bearer tokens in a static cache shared across all contexts, keyed only on endpoint and client ID. When multiple profiles share these identifiers but use different scopes or client secrets, the resolver reuses the wrong cached token, potentially granting an application access to services or scopes it should not have reached. This could allow a compromised internal service to replay tokens beyond their intended scope.

Technologies: [Apache Camel](https://junglewise.ai/threats/technologies/camel). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-94386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94386 being exploited in the wild.

**How severe is CVE-2026-94386?** Medium severity, with a CVSS score of 4.8, published 26 October 2026.

**Which products and versions are affected?** Apache Camel 4.19.0 before 4.22.2.

**Is there a fix for CVE-2026-94386?** Yes: fixed in Camel 4.22.2, 4.23.0. Until then: Disable token caching for all overlapping OAuth profiles by setting camel.oauth.NAME.cache-tokens=false (named profile) or camel.oauth.cache-tokens=false (default), or register separate client identifiers at the identity provider for each profile requiring different scope or client secret. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94386 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-94386?** Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Camel 4.22.2, 4.23.0

Disable token caching for all overlapping OAuth profiles by setting camel.oauth.NAME.cache-tokens=false (named profile) or camel.oauth.cache-tokens=false (default), or register separate client identifiers at the identity provider for each profile requiring different scope or client secret.

## Technical details

The OAuthClientCredentialsTokenResolver class caches OAuth 2.0 bearer tokens using only the token endpoint and client ID as cache keys, ignoring the scope and client secret. When two profiles share the same endpoint and client ID but differ in scope or client secret, both receive the same token, bypassing the intended profile-specific authentication. This is a logical flaw in the cache design that affects all deployments with multiple overlapping OAuth profiles; no user interaction or network-level attack is required.

## Affected products

- Apache Camel 4.19.0 before 4.22.2

## Timeline

- 2026-10-26: disclosed

## Related threats

- [Apache Camel SSRF in A2A webhook validator](https://junglewise.ai/threats/cve-2026-71569-server-side-request-forgery-ssrf-vulnerability-in-apache-camel)
- [Apache Camel Saxon component XXE in XQuery evaluation](https://junglewise.ai/threats/cve-2026-90885-improper-restriction-of-xml-external-entity-reference)
- [Apache Camel AWS2-S3 expression language injection in key handling](https://junglewise.ai/threats/cve-2026-95664-improper-neutralization-of-special-elements-used-in-an-expression)
- [Apache Camel Keycloak security policy token expiration bypass](https://junglewise.ai/threats/cve-2026-95663-insufficient-session-expiration-vulnerability-in-apache-camel)
- [Apache Camel Docling path traversal in output directory](https://junglewise.ai/threats/cve-2026-95629-improper-limitation-of-a-pathname-to-a-restricted-directory-path)