CVE-2026-95663— Apache Camel 远程代码执行漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Camel
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Camel Keycloak 组件中存在会话过期不足（Insufficient Session Expiration）漏洞。 受影响版本： Apache Camel 4.16.0 至 4.18.4（含），以及 4.19.0 至 4.22.1（含）。 漏洞详情： 当在 KeycloakSecurityPolicy 中启用令牌内省（token introspection）功能（即设置 ）时，安全处理器会将请求中的访问令牌发送至 Keycloak 的 OAuth 2.0 令牌内省端点进行验证。若响应中表明该
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-95663 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
来源: CVE Program / CVE List V5
Vulnerability Description
Insufficient Session Expiration vulnerability in Apache Camel Keycloak component.
This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2.
When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspection results are cached by default (introspectionCacheEnabled=true, introspectionCacheTtl=60 seconds), and both cache implementations shipped with the component, ConcurrentMapTokenCache and CaffeineTokenCache, expired an entry a fixed time after it was inserted, without bounding that lifetime by the exp claim that the cached response already carried. KeycloakSecurityProcessor in turn checked only the active flag of the result, on every path that uses introspection, and never compared exp with the current time. A response cached shortly before the token expired was therefore served to later requests carrying the same token for up to the configured time-to-live after the token's expiry, and those requests were admitted with the roles and permissions the expired token had carried, although RFC 7662, which defines token introspection, states that a response containing exp must not be cached beyond that time. The access token is supplied by the caller with each request, typically as a bearer token in the Authorization header, so a caller holding a token that was valid moments earlier could keep using it after it expired, for as long as the cached entry lived. The window is bounded by introspectionCacheTtl, which is 60 seconds by default and 300 to 600 seconds where the documentation's recommendation for internal services was followed, and it opens only for a token that the same Camel process introspected and cached while the token was still active. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium. The local JWT verification path, used when introspection is disabled, is not affected by this issue.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, set introspectionCacheEnabled=false on the KeycloakSecurityPolicy, so that every request is checked against the introspection endpoint, which reports an expired token as inactive, at the cost of one introspection call per request. Lowering introspectionCacheTtl only narrows the window and does not close it.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel | 4.16.0 ~ 4.18.5 | - |
|
二、漏洞 CVE-2026-95663 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-95663 的情报信息
请登录查看更多情报信息。
CVE-2026-95663 厂商安全公告 (2)
CVE-2026-95663 其他参考 (5)
-
https://issues.apache.org/jira/browse/CAMEL-24902 issue-tracking
-
https://camel.apache.org/security/CVE-2026-95663.html vendor-advisory
同批安全公告 · Apache Software Foundation · 2026-10-26 · 共 5 条
| CVE-2026-95628 | 5.4 MEDIUM | Apache Camel 路径验证绕过漏洞 |
| CVE-2026-95629 | 5.4 MEDIUM | Apache Camel 任意目录写入漏洞 |
| CVE-2026-95664 | 5.4 MEDIUM | Apache Camel 远程代码执行漏洞 |
| CVE-2026-101259 | 5.3 MEDIUM | Apache Camel CoAP 组件信息泄露漏洞 |