CVE-2026-53913

Critical [CVE-2026-23552 +1] Apache Camel: Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open')…

CVE-2026-53913Source published Jul 6, 2026Source updated Jul 9, 2026

This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and…

Affected products in this advisory

• Apache Camel Keycloak

Source-reported affected versions

• 4.15.0 through 4.18.3
• 4.19.0 through 4.21.0.

Source-reported fixed versions

• 4.21.0
• 4.18.3

Mitigation guidance

• Users are recommended to upgrade to version 4.21.0, which fixes the issue.
• If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3.
• For deployments that cannot upgrade immediately, configure a non-empty requiredRoles or requiredPermissions on every KeycloakSecurityPolicy so that the token-verification path is exercised, set allowTokenFromHeader to false where the token is not expected from the request header, or perform token verification at the framework layer ahead of the policy.