https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:21:22 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-28239 cnvd-2026-28239 https://cve.radiocsirt.org/vuln/cnvd-2026-28239 https://cve.radiocsirt.org/vuln/euvd-2026-333594 EUVD-2026-333594 https://cve.radiocsirt.org/vuln/euvd-2026-333594 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53913 <p>Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely (&#39;Failing Open&#39;) vulnerability in Apache Camel Keycloak Component.</p> <p>The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented &#39;Basic Setup&#39; - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the route…</p> <p>Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely (&#39;Failing Open&#39;) vulnerability in Apache Camel Keycloak Component.</p> <p>The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks. KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented &#39;Basic Setup&#39; - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the route…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53913 https://cve.radiocsirt.org/vuln/ghsa-qvc3-6q9x-95pj <p><strong>Affected:</strong> Maven: org.apache.camel:camel-keycloak</p> <p>Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely (&#39;Failing Open&#39;) vulnerability in Apache Camel Keycloak Component.</p> <p>The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks.</p> <p>KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented &#39;Basic Setup&#39; - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the rou…</p> <p><strong>Affected:</strong> Maven: org.apache.camel:camel-keycloak</p> <p>Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely (&#39;Failing Open&#39;) vulnerability in Apache Camel Keycloak Component.</p> <p>The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is non-empty - validates the roles, and - only if requiredPermissions is non-empty - validates the permissions. The actual cryptographic verification of the bearer access token (signature, issuer and expiry for a local JWT, or active-state and issuer for token introspection) is performed exclusively inside those role and permission checks.</p> <p>KeycloakSecurityPolicy defaults requiredRoles and requiredPermissions to empty - which is the documented &#39;Basic Setup&#39; - so on a route configured that way the role and permission checks are skipped and the access token is therefore never verified. The token-presence check still rejects a missing token, but an invalid token is accepted: any non-null value in the Authorization: Bearer header - including an arbitrary string or a forged, unsigned JWT - passes the policy and the request reaches the protected route, with no signature, issuer or expiry check and no request to Keycloak. The token is read from the inbound request header because allowTokenFromHeader defaults to true. Because the normal reason to place a route behind this policy is that the rou…</p> https://cve.radiocsirt.org/vuln/ghsa-qvc3-6q9x-95pj https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2203 <p>Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache Camel ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, serverseitige Request-Forgery durchzuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2203