CVE-2026-46455— Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
Quick assessment
Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache camel是美国Apache基金会开源的一个企业集成模式框架。 Apache Camel存在会话机制问题漏洞，该漏洞源于Keycloak组件会话过期不足，KeycloakSecurityHelper.parseAndVerifyAccessToken构建的TokenVerifier未应用IS_ACTIVE检查，导致已过期或尚未生效的访问令牌被接受为有效，从而使依赖此助手进行身份验证的路由接受超出其预期有效期的访问令牌。以下版本受到影响：4.18.0版本至4.18.3之前版本和4.19.0版本
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.18.0< 4.18.3 |
affected |
4.19.0< 4.21.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-46455
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.
The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default checks are installed only when withDefaultChecks() is called - so the built-in IS_ACTIVE predicate, which validates the token's exp (expiration) and nbf (not-before) claims, is never applied. As a result the helper verifies the token signature, subject and issuer but does not enforce the token's validity window: an access token that is expired, or not yet valid, is accepted as valid. Routes that rely on this helper to authenticate inbound requests therefore accept access tokens that are outside their intended lifetime.
This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0.
Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes KeycloakSecurityHelper.parseAndVerifyAccessToken include the TokenVerifier.IS_ACTIVE check so that expired or not-yet-valid access tokens are rejected, aligning the helper with Keycloak's default check set. For deployments that cannot upgrade immediately, enforce token expiration outside the helper - for example validate the access token's exp/nbf claims in the route before trusting it, keep Keycloak access-token lifetimes short, and ensure any upstream gateway or resource server also validates the token validity window.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Camel 会话机制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache camel是美国Apache基金会开源的一个企业集成模式框架。 Apache Camel存在会话机制问题漏洞，该漏洞源于Keycloak组件会话过期不足，KeycloakSecurityHelper.parseAndVerifyAccessToken构建的TokenVerifier未应用IS_ACTIVE检查，导致已过期或尚未生效的访问令牌被接受为有效，从而使依赖此助手进行身份验证的路由接受超出其预期有效期的访问令牌。以下版本受到影响：4.18.0版本至4.18.3之前版本和4.19.0版本
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.18.0 ~ 4.18.3 | - |
|
II. Public POCs for CVE-2026-46455
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46455
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-46455 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-06 · 39 CVEs total
| CVE-2026-46584 | Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail | |
| CVE-2026-48206 | Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP h | |
| CVE-2026-48205 | Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed nam | |
| CVE-2026-48204 | Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed n | |
| CVE-2026-48203 | Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non- | |
| CVE-2026-46726 | Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket quer | |
| CVE-2026-46592 | Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed name | |
| CVE-2026-46591 | Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header a | |
| CVE-2026-46590 | Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle manager | |
| CVE-2026-46585 | Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETUR | |
| CVE-2026-49086 | Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic | |
| CVE-2026-46457 | Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange withou | |
| CVE-2026-46456 | Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange with | |
| CVE-2026-46454 | Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange wi | |
| CVE-2026-46453 | Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel | |
| CVE-2026-43865 | Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed H | |
| CVE-2026-42527 | Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables | |
| CVE-2026-40859 | Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a | |
| CVE-2026-40047 | Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argum | |
| CVE-2026-56140 | Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStra |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Camel
-
CVE-2026-78329
Apache Camel: Camel-Undertow: the endpoint discarded the und -
CVE-2026-71300
Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch -
CVE-2026-63621
Apache Camel: Camel-Knative: CloudEvent extension fields rec -
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat -
CVE-2026-66907
Apache Camel: Camel-Google-Storage: the consumer appended th
Same vendor: Apache Software Foundation
-
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer -
CVE-2026-92899
Apache WSS4J: UsernameToken replay protection bypassed by re -
CVE-2026-92121
Apache WSS4J: WS-SecurityPolicy signature checks skipped in -
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing -
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Same weakness: CWE-613
-
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token -
CVE-2026-88805
Session Not Revoked Server-Side on Logout in Rancher -
CVE-2026-100711
froxlor before 2.3.12 Authentication Bypass via Session Pers -
CVE-2026-100624
Capgo.app before 12.264.5 Upload Expiry Bypass via build upl -
CVE-2026-100554
OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
V. Comments for CVE-2026-46455
No comments yet