CVE-2026-53913: Authentication Bypass in Apache Camel's camel-keycloak Security Policy

What Happened

Apache Camel's camel-keycloak component ships a KeycloakSecurityPolicy intended to enforce Keycloak-based authentication on Camel routes. A flaw in how the policy handles authentication (CWE-287, Improper Authentication) creates a fail-open condition: under certain conditions the policy fails to properly validate requests, allowing them through as if they were authenticated. The result is unauthenticated access to routes and endpoints that were supposed to be protected — a critical exposure for any integration flow gating sensitive operations behind Keycloak.

Affected Software

• Component: org.apache.camel:camel-keycloak (Maven)
• Affected versions: >= 4.15.0, < 4.18.3, and >= 4.19.0, < 4.21.0
• Severity: CVSS 9.8 (Critical)

Exploitation Status

A public proof-of-concept is available via GHSA-qvc3-6q9x-95pj. This is not yet listed in CISA KEV, but with a 9.8 CVSS score, a public PoC, and a straightforward authentication bypass, defenders should treat this as high-priority for detection and patching — weaponization typically follows quickly once PoC exploit paths for auth-bypass flaws are public.

How We Detect It

Our detection for CVE-2026-53913 is available across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the logic focuses on identifying requests reaching Camel routes protected by KeycloakSecurityPolicy that lack expected authentication artifacts — such as missing or malformed bearer tokens, absent Keycloak session/token validation events, or access patterns to protected endpoints that don't correlate with a preceding successful Keycloak auth flow. This lets defenders flag anomalous unauthenticated traffic reaching routes that should require Keycloak-backed authorization, independent of whether the underlying exploit technique evolves.

Learn More

For the full detection logic, including ready-to-deploy KQL, SPL, and other SIEM queries, atomic tests, and purple team guidance, see the CVE-2026-53913 detection page.