CVE-2026-95663 Apache Software Foundation CVE debrief

Who should care

Apache Camel users with KeycloakSecurityPolicy and token introspection enabled should assess exposure and upgrade or apply workarounds. Defenders should prioritize upgrades or workarounds, verify configurations, and review compensating controls for exposed systems.

Why it matters

CVE-2026-95663 allows for token reuse after expiration in Apache Camel Keycloak component when token introspection and caching are enabled. Defenders should assess exposure, prioritize upgrades or workarounds, and verify configurations.

• Potential for token reuse after expiration, allowing continued access with expired privileges
• Increased risk for users with long-lived tokens or high-traffic applications
• Need for inventory checks and potential system updates or patches
• Verification priority for deployments using affected versions and configurations

Technical summary

The Apache Camel Keycloak component has an Insufficient Session Expiration vulnerability. When token introspection is enabled, cached introspection results are not properly bounded by the token's expiration time, allowing for token reuse after expiration. The vulnerability affects Apache Camel versions 4.16.0 to 4.18.5 and 4.19.0 to 4.22.2. The issue grants nothing beyond what the token already carried: it allows no token forgery and no privilege escalation, and token introspection is not enabled by default, which is why the severity is assessed medium.

Defensive priority

Medium priority for Apache Camel deployments using KeycloakSecurityPolicy with token introspection and caching.

Recommended defensive actions

• Upgrade to Apache Camel version 4.23.0 or later
• For 4.22.x releases, upgrade to 4.22.2
• For 4.18.x releases, upgrade to 4.18.5
• Disable introspection caching (set introspectionCacheEnabled=false) as a temporary workaround
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and recommended upgrades. Apache Camel versions 4.16.0 to 4.18.5 and 4.19.0 to 4.22.2 are affected. The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.