---
title: "CVE-2026-53913: Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities"
url: https://erroneo.us/security/cve/CVE-2026-53913/
description: "CVE-2026-53913 (org.apache.camel:camel-keycloak (Maven)): Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-07-06
date_modified: 2026-07-24
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-53913"
kev: false
cvss: 9.8
epss: 0.01085
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-53913: Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.1% , percentile 65: FIRST’s model estimates a 1.1% chance of exploitation activity in the next 30 days, higher than 65% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes org.apache.camel:camel-keycloak (Maven) >= 4.15.0, < 4.18.3, fixed in 4.18.3 ; org.apache.camel:camel-keycloak (Maven) >= 4.19.0, < 4.21.0, fixed in 4.21.0 . Check your lockfile, including transitive dependencies.

## What it is

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented 'Basic Setup' - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the route performs server-side work, the bypass results in unauthenticated access to that work; where the protected route forwards to a code-execution-capable producer, it can result in unauthenticated remote code execution. This defect is independent of CVE-2026-23552: that issue concerned the issuer claim and was fixed by adding a check inside the verification routine, but here the verification routine is not reached at all in the default configuration, so the defect remains. This issue affects Apache Camel: from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. For deployments that cannot upgrade immediately, configure a non-empty requiredRoles or requiredPermissions on every KeycloakSecurityPolicy so that the token-verification…

## Affected packages

- Maven `org.apache.camel:camel-keycloak` >= 4.15.0, < 4.18.3 → fixed: 4.18.3
- Maven `org.apache.camel:camel-keycloak` >= 4.19.0, < 4.21.0 → fixed: 4.21.0

## Affected products (CVE record)

- Apache Software Foundation Apache Camel Keycloak: 4.15.0 < 4.18.3, 4.19.0 < 4.21.0

## Severity

- CISA-ADP CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.08% probability of exploitation activity in the next 30 days; percentile 65.

## Sources

- [camel.apache.org](https://camel.apache.org/security/CVE-2026-53913.html)
- [GitHub Advisory GHSA-qvc3-6q9x-95pj](https://github.com/advisories/GHSA-qvc3-6q9x-95pj)
- [CVE.org record CVE-2026-53913](https://www.cve.org/CVERecord?id=CVE-2026-53913)
- [NVD entry CVE-2026-53913](https://nvd.nist.gov/vuln/detail/CVE-2026-53913)
- [github.com](https://github.com/apache/camel/commit/1477cb4e87b2c301f1cdcddca5b153fbbef6934b)
- [issues.apache.org](https://issues.apache.org/jira/browse/CAMEL-23738)

---
Source page: https://erroneo.us/security/cve/CVE-2026-53913/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt