CVE-2026-53913 Google Chronicle · YARA-L

Detect Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913) in Google Chronicle

Apache Camel's camel-keycloak component contains a KeycloakSecurityPolicy that improperly handles authentication (CWE-287), resulting in missing authentication for a critical function and a fail-open condition. Affected versions >=4.15.0 <4.18.3 and >=4.19.0 <4.21.0 allow requests to bypass Keycloak-enforced authentication checks on Camel routes, permitting unauthenticated access to protected endpoints/routes. CVSS 9.8, PoC public via GHSA-qvc3-6q9x-95pj.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule camel_keycloak_auth_bypass_cve_2026_53913 {
  meta:
    description = "Detects unauthenticated successful access to Keycloak-protected Apache Camel routes indicative of CVE-2026-53913"
    severity = "CRITICAL"
    cve = "CVE-2026-53913"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /(secured|admin|protected)/ nocase
    $e.network.http.response_code = 200 or $e.network.http.response_code = 201 or $e.network.http.response_code = 202 or $e.network.http.response_code = 204
    $e.network.http.authorization = ""
    $e.principal.ip = $ip

  match:
    $ip over 5m

  condition:
    #e >= 3
}
critical severity medium confidence

Detects a burst of successful HTTP responses to Keycloak-protected Camel routes with no Authorization header present, indicating the fail-open bypass condition.

Data Sources

Network HTTP logsApplication/proxy logs

Required Tables

NETWORK_HTTP

False Positives & Tuning

  • Health-check endpoints intentionally unauthenticated
  • Proxy logs that strip auth headers before ingestion
  • mTLS-only internal service traffic
  • Authorized vulnerability scans

Other platforms for CVE-2026-53913

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate unauthenticated request to Keycloak-protected Camel route

    Expected signal: Application/access log entry showing a request to /secured/test-endpoint with no Authorization header and an HTTP 200-series response.

  2. Test 2Repeated bypass attempts to trigger threshold-based alerting

    Expected signal: Five sequential log entries within a 5-minute window from the same client IP hitting /admin/config without Authorization headers, each returning 2xx.

  3. Test 3Windows-based PowerShell simulation of unauthenticated access

    Expected signal: Access log entry recording a request to /protected/data with an empty Authorization header field and a successful HTTP status code.

Last updated: 2026-08-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the affected application uses org.apache.camel:camel-keycloak in the vulnerable version range (>=4.15.0 <4.18.3 or >=4.19.0 <4.21.0) via dependency manifest, SBOM, or classpath inspection.
  2. Review access logs for the flagged routes to determine whether requests lacking Authorization headers received successful (2xx) responses, confirming the fail-open bypass was actually exploited rather than just reachable.
  3. Identify which Camel routes are configured with KeycloakSecurityPolicy and cross-reference actual traffic against expected authenticated-only access patterns.
  4. Check for anomalous data access, configuration changes, or downstream API calls originating from sessions that bypassed authentication.

Containment

  1. Upgrade camel-keycloak to a patched version (>=4.18.3 or >=4.21.0) immediately, or apply the vendor-provided hotfix/commit if upgrading is not immediately feasible.
  2. Place an external authentication/authorization enforcement layer (API gateway, reverse proxy with mandatory auth) in front of affected Camel routes as a compensating control until patched.
  3. Temporarily disable or restrict network access to the affected Camel endpoints if patching cannot occur immediately and exploitation is suspected.
  4. Rotate any credentials or tokens that may have been exposed via routes accessed without proper authentication.

Evidence Collection

  1. Preserve Camel application logs, access logs, and reverse proxy logs covering the suspected exploitation window.
  2. Capture the deployed camel-keycloak version, route configuration (XML/Java DSL), and KeycloakSecurityPolicy settings for forensic review.
  3. Collect network flow data and any WAF/IDS alerts corresponding to the affected route paths and timeframe.
  4. Export a list of all requests that reached protected routes without valid authentication, including source IPs, timestamps, and response payloads.

Escalation Criteria

  • !Evidence that unauthenticated requests successfully retrieved sensitive data or performed privileged actions (e.g., admin functions, data exports).
  • !Exploitation observed against internet-facing production systems with confirmed PoC-based attack patterns.
  • !Multiple distinct source IPs or automated tooling patterns indicating mass scanning/exploitation attempts.
  • !Any indication of lateral movement or follow-on activity originating from a session established via the authentication bypass.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Camel application/route logs showing requests to KeycloakSecurityPolicy-protected endpoints
  • >Reverse proxy / API gateway access logs correlating request headers and response codes
  • >Application server heap/thread dumps if runtime exploitation analysis is required
  • >Deployed Maven dependency manifest (pom.xml/effective-pom) confirming camel-keycloak version

Tuning Guidance

Tune thresholds based on baseline traffic to known health-check or intentionally public routes; exclude documented unauthenticated endpoints and internal mTLS-based service accounts. Increase the request_count threshold in high-traffic environments to reduce noise from load balancer probes, and validate route_path patterns against your organization's actual protected-route naming conventions.

Hunting Queries

Broad hunt for any historical requests to Camel routes lacking authorization headers, to baseline exposure prior to patching.

Hunting — KQL
kql 
AppLogs_CL
| where LogEntry_s has "camel-keycloak"
| where isempty(AuthorizationHeader_s)
| summarize count() by RoutePath_s, ClientIP_s, bin(TimeGenerated,1h)
| where count_ > 0
Hunting — SPL
spl 
index=app_logs sourcetype=camel_access_log "camel-keycloak" Authorization=""
| stats count by route_path, client_ip, _time

Atomic Red Team Tests

Test 1 Simulate unauthenticated request to Keycloak-protected Camel route
linux

Sends an HTTP request without an Authorization header to a lab Camel route configured with KeycloakSecurityPolicy to validate whether the fail-open bypass occurs.

Command

bash 
curl -s -o /tmp/camel_test_response.txt -w '%{http_code}' http://localhost:8080/secured/test-endpoint

Cleanup

bash 
rm -f /tmp/camel_test_response.txt

Expected Telemetry

Application/access log entry showing a request to /secured/test-endpoint with no Authorization header and an HTTP 200-series response.

Expected Detection

Detection rule flags the client IP for a successful request lacking authorization to a protected route path.

Test 2 Repeated bypass attempts to trigger threshold-based alerting
linux

Issues multiple rapid unauthenticated requests to a protected Camel route to simulate scanning/exploitation and validate count-based detection thresholds.

Command

bash 
for i in $(seq 1 5); do curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8080/admin/config; sleep 1; done

Cleanup

bash 
none required (no persistent artifacts created)

Expected Telemetry

Five sequential log entries within a 5-minute window from the same client IP hitting /admin/config without Authorization headers, each returning 2xx.

Expected Detection

Detection triggers once the request_count threshold (>=3 within 5 minutes) is met for the client IP.

Test 3 Windows-based PowerShell simulation of unauthenticated access
windows

Uses PowerShell's Invoke-WebRequest to send a request without credentials to a lab-hosted Camel endpoint to validate cross-platform log generation for the bypass condition.

Command

powershell 
Invoke-WebRequest -Uri 'http://localhost:8080/protected/data' -UseBasicParsing -Headers @{} | Select-Object StatusCode

Cleanup

powershell 
No cleanup required; no files or state persisted by this command.

Expected Telemetry

Access log entry recording a request to /protected/data with an empty Authorization header field and a successful HTTP status code.

Expected Detection

SIEM rule ingests the log entry and flags it as a candidate authentication-bypass event pending threshold correlation.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections