Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913)

// Detect unauthenticated access to Camel routes protected by KeycloakSecurityPolicy
// Requires ingestion of Camel/application logs into a custom table AppLogs_CL
let SuspiciousStatusCodes = dynamic([200,201,202,204]);
AppLogs_CL
| where LogEntry_s has_any ("camel-keycloak", "KeycloakSecurityPolicy", "camel.route")
| where TimeGenerated > ago(1h)
| where isempty(AuthorizationHeader_s) or isempty(BearerToken_s)
| where HttpStatusCode_d in (SuspiciousStatusCodes)
| where RoutePath_s has_any ("/secured", "/admin", "/api/protected")
| summarize RequestCount = count(), Paths = make_set(RoutePath_s), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP_s, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| sort by RequestCount desc

index=app_logs sourcetype=camel_access_log ("camel-keycloak" OR "KeycloakSecurityPolicy")
| eval has_auth=if(isnull(Authorization) OR len(Authorization)=0, 0, 1)
| where has_auth=0 AND (status=200 OR status=201 OR status=202 OR status=204)
| where match(route_path, "(?i)(secured|admin|protected)")
| bin _time span=5m
| stats count as request_count, values(route_path) as paths, min(_time) as first_seen, max(_time) as last_seen by client_ip, _time
| where request_count >= 3
| sort - request_count

sequence by client.ip with maxspan=5m
  [network where event.dataset == "camel.access" and
    (http.request.headers.authorization == null or http.request.headers.authorization == "") and
    http.response.status_code in (200,201,202,204) and
    url.path : ("*secured*", "*admin*", "*protected*")]
  [network where event.dataset == "camel.access" and
    (http.request.headers.authorization == null or http.request.headers.authorization == "") and
    http.response.status_code in (200,201,202,204) and
    url.path : ("*secured*", "*admin*", "*protected*")]

SELECT sourceip, destinationip, url, httpstatuscode, COUNT(*) as request_count
FROM events
WHERE logsourcename(logsourceid) ILIKE '%Camel%'
AND UTF8(payload) ILIKE '%KeycloakSecurityPolicy%'
AND (authorizationheader IS NULL OR authorizationheader = '')
AND httpstatuscode IN (200,201,202,204)
AND (url ILIKE '%secured%' OR url ILIKE '%admin%' OR url ILIKE '%protected%')
GROUP BY sourceip, destinationip, url, httpstatuscode
HAVING COUNT(*) >= 3
LAST 1 HOURS

_sourceCategory=app/camel
| where !isNull(logEntry) and (logEntry matches "*KeycloakSecurityPolicy*" or logEntry matches "*camel-keycloak*")
| parse regex field=logEntry "status=(?<status>\d+)" 
| parse regex field=logEntry "path=(?<path>\S+)"
| where isEmpty(authorizationHeader)
| where status in (200,201,202,204)
| where path matches "*secured*" or path matches "*admin*" or path matches "*protected*"
| timeslice 5m
| count by client_ip, _timeslice
| where _count >= 3
| sort by _count

rule camel_keycloak_auth_bypass_cve_2026_53913 {
  meta:
    description = "Detects unauthenticated successful access to Keycloak-protected Apache Camel routes indicative of CVE-2026-53913"
    severity = "CRITICAL"
    cve = "CVE-2026-53913"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /(secured|admin|protected)/ nocase
    $e.network.http.response_code = 200 or $e.network.http.response_code = 201 or $e.network.http.response_code = 202 or $e.network.http.response_code = 204
    $e.network.http.authorization = ""
    $e.principal.ip = $ip

  match:
    $ip over 5m

  condition:
    #e >= 3
}

#event_simple_name=HttpRequestEvent
| RequestUrl=/*secured*|*admin*|*protected*/i
| AuthorizationHeader="" OR !AuthorizationHeader=*
| ResponseCode=200 OR ResponseCode=201 OR ResponseCode=202 OR ResponseCode=204
| RawProcessLine=/camel-keycloak|KeycloakSecurityPolicy/i
| groupBy([ClientIP, bucket(_time, 5m)], function=([count(as=request_count)]))
| test(request_count>=3)
| sort(request_count, order=desc)