CVE-2026-53913 Microsoft Sentinel · KQL

Detect Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913) in Microsoft Sentinel

Apache Camel's camel-keycloak component contains a KeycloakSecurityPolicy that improperly handles authentication (CWE-287), resulting in missing authentication for a critical function and a fail-open condition. Affected versions >=4.15.0 <4.18.3 and >=4.19.0 <4.21.0 allow requests to bypass Keycloak-enforced authentication checks on Camel routes, permitting unauthenticated access to protected endpoints/routes. CVSS 9.8, PoC public via GHSA-qvc3-6q9x-95pj.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
// Detect unauthenticated access to Camel routes protected by KeycloakSecurityPolicy
// Requires ingestion of Camel/application logs into a custom table AppLogs_CL
let SuspiciousStatusCodes = dynamic([200,201,202,204]);
AppLogs_CL
| where LogEntry_s has_any ("camel-keycloak", "KeycloakSecurityPolicy", "camel.route")
| where TimeGenerated > ago(1h)
| where isempty(AuthorizationHeader_s) or isempty(BearerToken_s)
| where HttpStatusCode_d in (SuspiciousStatusCodes)
| where RoutePath_s has_any ("/secured", "/admin", "/api/protected")
| summarize RequestCount = count(), Paths = make_set(RoutePath_s), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP_s, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| sort by RequestCount desc
critical severity medium confidence

Flags requests reaching Keycloak-protected Camel routes without an authorization header/bearer token yet still receiving a successful HTTP response, indicating the fail-open authentication bypass.

Data Sources

Application logsReverse proxy / load balancer logsCamel route access logs

Required Tables

AppLogs_CL

False Positives & Tuning

  • Health-check endpoints intentionally left unauthenticated
  • Misconfigured logging that omits auth headers even on valid authenticated requests
  • Internal service-to-service calls using mTLS instead of bearer tokens
  • Load balancer probes hitting the same route paths

Other platforms for CVE-2026-53913

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate unauthenticated request to Keycloak-protected Camel route

    Expected signal: Application/access log entry showing a request to /secured/test-endpoint with no Authorization header and an HTTP 200-series response.

  2. Test 2Repeated bypass attempts to trigger threshold-based alerting

    Expected signal: Five sequential log entries within a 5-minute window from the same client IP hitting /admin/config without Authorization headers, each returning 2xx.

  3. Test 3Windows-based PowerShell simulation of unauthenticated access

    Expected signal: Access log entry recording a request to /protected/data with an empty Authorization header field and a successful HTTP status code.

Last updated: 2026-08-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the affected application uses org.apache.camel:camel-keycloak in the vulnerable version range (>=4.15.0 <4.18.3 or >=4.19.0 <4.21.0) via dependency manifest, SBOM, or classpath inspection.
  2. Review access logs for the flagged routes to determine whether requests lacking Authorization headers received successful (2xx) responses, confirming the fail-open bypass was actually exploited rather than just reachable.
  3. Identify which Camel routes are configured with KeycloakSecurityPolicy and cross-reference actual traffic against expected authenticated-only access patterns.
  4. Check for anomalous data access, configuration changes, or downstream API calls originating from sessions that bypassed authentication.

Containment

  1. Upgrade camel-keycloak to a patched version (>=4.18.3 or >=4.21.0) immediately, or apply the vendor-provided hotfix/commit if upgrading is not immediately feasible.
  2. Place an external authentication/authorization enforcement layer (API gateway, reverse proxy with mandatory auth) in front of affected Camel routes as a compensating control until patched.
  3. Temporarily disable or restrict network access to the affected Camel endpoints if patching cannot occur immediately and exploitation is suspected.
  4. Rotate any credentials or tokens that may have been exposed via routes accessed without proper authentication.

Evidence Collection

  1. Preserve Camel application logs, access logs, and reverse proxy logs covering the suspected exploitation window.
  2. Capture the deployed camel-keycloak version, route configuration (XML/Java DSL), and KeycloakSecurityPolicy settings for forensic review.
  3. Collect network flow data and any WAF/IDS alerts corresponding to the affected route paths and timeframe.
  4. Export a list of all requests that reached protected routes without valid authentication, including source IPs, timestamps, and response payloads.

Escalation Criteria

  • !Evidence that unauthenticated requests successfully retrieved sensitive data or performed privileged actions (e.g., admin functions, data exports).
  • !Exploitation observed against internet-facing production systems with confirmed PoC-based attack patterns.
  • !Multiple distinct source IPs or automated tooling patterns indicating mass scanning/exploitation attempts.
  • !Any indication of lateral movement or follow-on activity originating from a session established via the authentication bypass.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Camel application/route logs showing requests to KeycloakSecurityPolicy-protected endpoints
  • >Reverse proxy / API gateway access logs correlating request headers and response codes
  • >Application server heap/thread dumps if runtime exploitation analysis is required
  • >Deployed Maven dependency manifest (pom.xml/effective-pom) confirming camel-keycloak version

Tuning Guidance

Tune thresholds based on baseline traffic to known health-check or intentionally public routes; exclude documented unauthenticated endpoints and internal mTLS-based service accounts. Increase the request_count threshold in high-traffic environments to reduce noise from load balancer probes, and validate route_path patterns against your organization's actual protected-route naming conventions.

Hunting Queries

Broad hunt for any historical requests to Camel routes lacking authorization headers, to baseline exposure prior to patching.

Hunting — KQL
kql 
AppLogs_CL
| where LogEntry_s has "camel-keycloak"
| where isempty(AuthorizationHeader_s)
| summarize count() by RoutePath_s, ClientIP_s, bin(TimeGenerated,1h)
| where count_ > 0
Hunting — SPL
spl 
index=app_logs sourcetype=camel_access_log "camel-keycloak" Authorization=""
| stats count by route_path, client_ip, _time

Atomic Red Team Tests

Test 1 Simulate unauthenticated request to Keycloak-protected Camel route
linux

Sends an HTTP request without an Authorization header to a lab Camel route configured with KeycloakSecurityPolicy to validate whether the fail-open bypass occurs.

Command

bash 
curl -s -o /tmp/camel_test_response.txt -w '%{http_code}' http://localhost:8080/secured/test-endpoint

Cleanup

bash 
rm -f /tmp/camel_test_response.txt

Expected Telemetry

Application/access log entry showing a request to /secured/test-endpoint with no Authorization header and an HTTP 200-series response.

Expected Detection

Detection rule flags the client IP for a successful request lacking authorization to a protected route path.

Test 2 Repeated bypass attempts to trigger threshold-based alerting
linux

Issues multiple rapid unauthenticated requests to a protected Camel route to simulate scanning/exploitation and validate count-based detection thresholds.

Command

bash 
for i in $(seq 1 5); do curl -s -o /dev/null -w '%{http_code}\n' http://localhost:8080/admin/config; sleep 1; done

Cleanup

bash 
none required (no persistent artifacts created)

Expected Telemetry

Five sequential log entries within a 5-minute window from the same client IP hitting /admin/config without Authorization headers, each returning 2xx.

Expected Detection

Detection triggers once the request_count threshold (>=3 within 5 minutes) is met for the client IP.

Test 3 Windows-based PowerShell simulation of unauthenticated access
windows

Uses PowerShell's Invoke-WebRequest to send a request without credentials to a lab-hosted Camel endpoint to validate cross-platform log generation for the bypass condition.

Command

powershell 
Invoke-WebRequest -Uri 'http://localhost:8080/protected/data' -UseBasicParsing -Headers @{} | Select-Object StatusCode

Cleanup

powershell 
No cleanup required; no files or state persisted by this command.

Expected Telemetry

Access log entry recording a request to /protected/data with an empty Authorization header field and a successful HTTP status code.

Expected Detection

SIEM rule ingests the log entry and flags it as a candidate authentication-bypass event pending threshold correlation.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections