CVE-2026-95663
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
02 Description
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.24% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 15.4% of scored records. A rank, not a probability.
- NVD base score
- 4.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-26.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-26 08:42Z3 DAYS AGO
- Last updated
- 2026-10-26 08:42Z3 DAYS AGO
- Reserved
- 2026-09-22
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 4.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-613Insufficient Session ExpirationBase
- Data version
- 5.2
- Document digest
- 29969493f086e2f8814a8389a4ef6b1a21fd89fac4977ff1e377a342dd6f3525
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-95663https://camel.apache.org/security/CVE-2026-95663.html
- issues.apache.orgCAMEL-24902https://issues.apache.org/jira/browse/CAMEL-24902
- github.comFix on main, released in 4.23.0 (commit 7bfacb70d3300f97a130eda92b7b86ec5d8b11af)https://github.com/apache/camel/pull/26747
- github.comBackport to camel-4.22.x for 4.22.2 (commit 66fd7034911aebcaffa80bae4ece265feb2895bb)https://github.com/apache/camel/pull/27182
- github.comBackport to camel-4.18.x, released in 4.18.5 (commit 6be02c19c0259a983db5910e28deb4b3a00c9d22)https://github.com/apache/camel/pull/27183
- camel.apache.orgCVE-2026-46455, expired tokens accepted on the local JWT verification path, distinct from this issuehttps://camel.apache.org/security/CVE-2026-46455.html
- camel.apache.orgCVE-2026-85301, issuer check skipped on the same introspection path, distinct from this issuehttps://camel.apache.org/security/CVE-2026-85301.html
07 Remediation
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. Both cache implementations now bound the lifetime of each entry by the shorter of introspectionCacheTtl and the time remaining until the token's exp, a result whose token has already expired is never served from the cache, and KeycloakSecurityProcessor now rejects a token whose exp lies in the past on every path that uses introspection, so expiry is enforced on the introspection path as it is on the local JWT verification path. The 4.16.x, 4.17.x and 4.19.x to 4.21.x releases streams reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.