CVE-2026-53913: Apache Camel Authentication Bypass Flaw

CVE-2026-53913 Overview

CVE-2026-53913 is an authentication bypass vulnerability in the Apache Camel Keycloak component. The KeycloakSecurityPolicy guards protected routes by executing KeycloakSecurityProcessor.beforeProcess(), which performs token verification only inside the role and permission checks. When requiredRoles and requiredPermissions are both empty — the documented Basic Setup default — the cryptographic verification path is never reached. Any non-null value in the Authorization: Bearer header, including an arbitrary string or a forged unsigned JSON Web Token (JWT), passes the policy. The flaw affects Apache Camel from 4.15.0 before 4.18.3 and from 4.19.0 before 4.21.0.

Critical Impact
Unauthenticated attackers can bypass Keycloak authentication and reach protected Camel routes. When the route forwards to a code-execution-capable producer, this yields unauthenticated remote code execution.

Affected Products

Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.19.0 through 4.20.x
camel-keycloak component with default KeycloakSecurityPolicy configuration

Discovery Timeline

2026-07-06 - CVE-2026-53913 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-53913

Vulnerability Analysis

The KeycloakSecurityPolicy executes three sequential checks in beforeProcess(). It rejects requests carrying no access token, validates roles only when requiredRoles is non-empty, and validates permissions only when requiredPermissions is non-empty. The cryptographic verification of the bearer token — signature, issuer, and expiry for local JWTs, or active-state and issuer for token introspection — runs exclusively inside the role and permission validators.

When operators follow the documented Basic Setup, both requiredRoles and requiredPermissions remain empty. The policy skips both validators and never invokes the token verification routine. Only the token-presence check runs, and it accepts any non-null header value. Attackers can submit forged, unsigned JWTs or arbitrary strings and reach the protected route without contacting Keycloak.

This defect is independent of CVE-2026-23552. That earlier issue addressed the issuer claim inside the verification routine, but here the verification routine itself is never reached in the default configuration. The bypass classifies as Improper Authentication [CWE-287].

Root Cause

Token verification logic is embedded inside the role and permission checks rather than executed unconditionally. Combined with empty defaults for requiredRoles and requiredPermissions, this design causes the policy to fail open when configured according to vendor documentation.

Attack Vector

The attacker sends an HTTP request to a Camel route protected by KeycloakSecurityPolicy. Because allowTokenFromHeader defaults to true, the policy reads the bearer token from the inbound Authorization header. Any non-empty value satisfies the presence check. The request reaches the protected route with no signature, issuer, or expiry validation and no round trip to the Keycloak server.

See the Apache Camel CVE-2026-53913 Advisory for vendor technical details.

Detection Methods for CVE-2026-53913

Indicators of Compromise

Inbound requests to Camel routes with malformed or unsigned JWTs in the Authorization: Bearer header.
Successful route executions with no corresponding Keycloak token introspection or validation logs.
Unusual invocations of downstream producers reachable through camel-keycloak-protected routes from unauthenticated sources.

Detection Strategies

Audit deployed Apache Camel versions and flag any instance in the 4.15.0–4.18.2 or 4.19.0–4.20.x range using camel-keycloak.
Inspect Camel route definitions for KeycloakSecurityPolicy beans that omit requiredRoles and requiredPermissions configuration.
Correlate application access logs with Keycloak introspection or JWKS request logs to identify authenticated route hits lacking matching identity provider activity.

Monitoring Recommendations

Enable verbose logging on KeycloakSecurityProcessor to record token validation outcomes for every request.
Alert on HTTP requests carrying non-standard bearer values, such as short strings, unsigned JWTs (alg: none), or tokens with invalid signatures.
Track downstream producer invocations originating from Keycloak-protected routes and baseline expected caller identities.

How to Mitigate CVE-2026-53913

Immediate Actions Required

Upgrade Apache Camel to version 4.21.0, or to 4.18.3 for deployments tracking the 4.18.x stream.
Inventory all KeycloakSecurityPolicy usages and confirm each defines requiredRoles or requiredPermissions.
Restrict network exposure of protected Camel routes until patches are applied, especially routes forwarding to code-execution-capable producers.

Patch Information

Apache has released fixed versions 4.18.3 and 4.21.0. Refer to the Apache Camel CVE-2026-53913 Advisory for full remediation details. Users on any affected 4.15.0–4.18.2 or 4.19.0–4.20.x release must upgrade to receive the fix.

Workarounds

Configure a non-empty requiredRoles or requiredPermissions value on every KeycloakSecurityPolicy instance so the token verification path executes.
Set allowTokenFromHeader to false on routes where the token is not expected in the request header.
Perform bearer token verification at the framework layer, such as a servlet filter or API gateway, before the request reaches the Camel policy.

bash

# Configuration example - enforce role validation to trigger token verification
# Camel route configuration (Java DSL)
# KeycloakSecurityPolicy policy = new KeycloakSecurityPolicy();
# policy.setRequiredRoles(Arrays.asList("authenticated-user"));
# policy.setAllowTokenFromHeader(false);
# from("direct:protected").policy(policy).to("...");