Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Apache Camel patches two medium token-cache flaws in 4.22.2

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two medium Apache Camel flaws can reuse client-credentials tokens or accept expired access tokens; fixes are in 4.22.2.

Andrea Cosentino reported two medium-severity Apache Camel flaws, both scored CVSS 3.1 4.8, and neither post mentions attacks. CVE-2026-94386 affects org.apache.camel:camel-oauth from 4.19.0 before 4.22.2: an under-keyed JVM-global cache can reuse client-credentials bearer tokens across scopes. CVE-2026-95663 affects camel-keycloak 4.16.0 before 4.18.5 and 4.19.0 before 4.22.2: cached token introspection results are not bounded by access-token expiry, so the security policy can accept expired tokens. The stated fixed release for the affected ranges is 4.22.2.

Key facts
  • CVE-2026-94386 affects camel-oauth 4.19.0 before 4.22.2.
  • CVE-2026-95663 affects camel-keycloak 4.16.0 before 4.18.5 and 4.19.0 before 4.22.2.
  • Both issues are CVSS 3.1 4.8, vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
  • CVE-2026-95663 is classified as insufficient session expiration.
  • Neither oss-security post mentions exploitation.
Analyze CVE-2026-94386 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026oss-security posts Camel OAuth cross-scope token-reuse flaw. · oss-security
  2. Oct 23, 2026oss-security posts Camel Keycloak expired-token acceptance flaw. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityDetails CVE-2026-94386 camel-oauth under-keyed token cache and fix 4.22.2.
  • oss-securityDetails CVE-2026-95663 ranges, expiry gap, and session-expiration classification.
CVEs
CVE-2026-94386CVE-2026-95663
Vendors
Apache
Products
Apache Camelcamel-oauthcamel-keycloak

Coverage

oldest first · one row per article · UTC
  1. · 7d ago oss-securityFirst report

    Apache Camel OAuth cache reuses tokens across scopes (CVE-2026-94386)

    camel-oauth from 4.19.0 before 4.22.2 can reuse client-credentials bearer tokens; CVSS 3.1 is 4.8.

  2. · 7d ago oss-security

    Camel Keycloak accepts expired tokens from unbounded cache (CVE-2026-95663)

    Cached introspection results are not limited by token expiry, so expired access tokens can still be accepted.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-94386
Under-keyed OAuth token cache in Apache Camel before 4.22.2
4.8—
CVE-2026-95663
Insufficient Session Expiration in Apache Camel Keycloak
4.8—