Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-53913.
Unlock with Pro - from £29/user/moDetect Apache Camel camel-keycloak KeycloakSecurityPolicy Authentication Bypass (CVE-2026-53913) in Microsoft Sentinel
Apache Camel's camel-keycloak component contains a KeycloakSecurityPolicy that improperly handles authentication (CWE-287), resulting in missing authentication for a critical function and a fail-open condition. Affected versions >=4.15.0 <4.18.3 and >=4.19.0 <4.21.0 allow requests to bypass Keycloak-enforced authentication checks on Camel routes, permitting unauthenticated access to protected endpoints/routes. CVSS 9.8, PoC public via GHSA-qvc3-6q9x-95pj.
MITRE ATT&CK
KQL Detection Query
// Detect unauthenticated access to Camel routes protected by KeycloakSecurityPolicy
// Requires ingestion of Camel/application logs into a custom table AppLogs_CL
let SuspiciousStatusCodes = dynamic([200,201,202,204]);
AppLogs_CL
| where LogEntry_s has_any ("camel-keycloak", "KeycloakSecurityPolicy", "camel.route")
| where TimeGenerated > ago(1h)
| where isempty(AuthorizationHeader_s) or isempty(BearerToken_s)
| where HttpStatusCode_d in (SuspiciousStatusCodes)
| where RoutePath_s has_any ("/secured", "/admin", "/api/protected")
| summarize RequestCount = count(), Paths = make_set(RoutePath_s), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP_s, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| sort by RequestCount descFlags requests reaching Keycloak-protected Camel routes without an authorization header/bearer token yet still receiving a successful HTTP response, indicating the fail-open authentication bypass.
Data Sources
Required Tables
False Positives & Tuning
- Health-check endpoints intentionally left unauthenticated
- Misconfigured logging that omits auth headers even on valid authenticated requests
- Internal service-to-service calls using mTLS instead of bearer tokens
- Load balancer probes hitting the same route paths
Other platforms for CVE-2026-53913
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate unauthenticated request to Keycloak-protected Camel route
Expected signal: Application/access log entry showing a request to /secured/test-endpoint with no Authorization header and an HTTP 200-series response.
- Test 2Repeated bypass attempts to trigger threshold-based alerting
Expected signal: Five sequential log entries within a 5-minute window from the same client IP hitting /admin/config without Authorization headers, each returning 2xx.
- Test 3Windows-based PowerShell simulation of unauthenticated access
Expected signal: Access log entry recording a request to /protected/data with an empty Authorization header field and a successful HTTP status code.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-53913 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month