This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 79cb411bcbcdc952717a237b67ea5c72d65193fb Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 10:36:37 2026 +0200 Added CVE-2026-95663 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-95663.md | 25 +++++++++++++++++++++ content/security/CVE-2026-95663.txt.asc | 39 +++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/content/security/CVE-2026-95663.md b/content/security/CVE-2026-95663.md new file mode 100644 index 00000000..5a0d0c88 --- /dev/null +++ b/content/security/CVE-2026-95663.md @@ -0,0 +1,25 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-95663" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95663.html +draft: false +type: security-advisory +cve: CVE-2026-95663 +severity: MEDIUM +summary: "Camel-Keycloak: Security policy accepts expired access tokens because cached token introspection results are not bounded by the token expiry" +description: "When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspectio [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrad [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24902 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26747 (commit 7bfacb70d3300f97a130eda92b7b86ec5d8b11af), and backported to camel-4.22.x in https://github.com/apache/camel/pull/27182 (commit 66fd7034911aebcaffa80bae4ece265feb2895bb) and to camel-4.18.x in https://github.com/apache/camel/pull/27183 (commit 6be02c19c0259a983db5910e28deb4b3a00c9d22). + +Both cache implementations now bound the lifetime of each entry by the shorter of introspectionCacheTtl and the time remaining until the token's exp, and a result whose token has already expired is never served from the cache. Independently of the cache, KeycloakSecurityProcessor now rejects a token whose exp lies in the past on every path that uses introspection, so expiry is enforced on the introspection path as it is on the local JWT verification path. A response that carries no exp c [...] + +Token introspection was added to camel-keycloak in 4.16.0 together with the result cache, and the cache expired its entries by insertion time from the start, so every release from 4.16.0 up to the fixed versions is affected, the 4.18.x line included. Earlier releases are not affected: camel-keycloak 4.15.0, the release that introduced the component, has no token introspection support, and the 4.14.x line and earlier do not ship camel-keycloak at all. + +This issue is distinct from CVE-2026-46455, which concerned the local JWT verification path: the token verifier there was built without its IS_ACTIVE check, so the validity window of a token was not enforced at all, and the fix in 4.18.3 and 4.21.0 added that check. When useTokenIntrospection is enabled the local verification path is not used and expiry is decided from the introspection response instead, so that fix did not reach the gap described here, which affects releases with and wi [...] diff --git a/content/security/CVE-2026-95663.txt.asc b/content/security/CVE-2026-95663.txt.asc new file mode 100644 index 00000000..0553c5ac --- /dev/null +++ b/content/security/CVE-2026-95663.txt.asc @@ -0,0 +1,39 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-95663" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95663.html +draft: false +type: security-advisory +cve: CVE-2026-95663 +severity: MEDIUM +summary: "Camel-Keycloak: Security policy accepts expired access tokens because cached token introspection results are not bounded by the token expiry" +description: "When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection endpoint reports a token as inactive once its exp (expiration) time has passed, so on this path the active flag is what enforces token expiry. Introspectio [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.16.x, 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrad [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24902 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26747 (commit 7bfacb70d3300f97a130eda92b7b86ec5d8b11af), and backported to camel-4.22.x in https://github.com/apache/camel/pull/27182 (commit 66fd7034911aebcaffa80bae4ece265feb2895bb) and to camel-4.18.x in https://github.com/apache/camel/pull/27183 (commit 6be02c19c0259a983db5910e28deb4b3a00c9d22). + +Both cache implementations now bound the lifetime of each entry by the shorter of introspectionCacheTtl and the time remaining until the token's exp, and a result whose token has already expired is never served from the cache. Independently of the cache, KeycloakSecurityProcessor now rejects a token whose exp lies in the past on every path that uses introspection, so expiry is enforced on the introspection path as it is on the local JWT verification path. A response that carries no exp c [...] + +Token introspection was added to camel-keycloak in 4.16.0 together with the result cache, and the cache expired its entries by insertion time from the start, so every release from 4.16.0 up to the fixed versions is affected, the 4.18.x line included. Earlier releases are not affected: camel-keycloak 4.15.0, the release that introduced the component, has no token introspection support, and the 4.14.x line and earlier do not ship camel-keycloak at all. + +This issue is distinct from CVE-2026-46455, which concerned the local JWT verification path: the token verifier there was built without its IS_ACTIVE check, so the validity window of a token was not enforced at all, and the fix in 4.18.3 and 4.21.0 added that check. When useTokenIntrospection is enabled the local verification path is not used and expiry is decided from the introspection response instead, so that fix did not reach the gap described here, which affects releases with and wi [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ +QQCuYwf/STBY7fk29KzLiyKZxG1/ibstTESM1A1PUpvqERTj28n2QXZt6aplYoWD +59wtBBnAneATbYxxrX0gGTeck7CNPofWdk519IG2teC2YJLCneSWnsI8avulfkHC +e46HVskwUyGcQUOIekqESplIio5e5oOgjGpZDOyytvRD9GhiB4O+Y1w0oJt/eEe9 +xq7ZMuTacDmObU/DJ1IL539g8efZ2Go18qoTKK9LyxKjwX78KjkvqHFL+baSkAe2 +OrDSOvYOino+O8VzJEzvHG/lJX08WTnkJdTiG+/Kwr9XjX3/Gdy3uJp+Zck5pFlE +aXTCeQPcwEInWGk8sLn/t/Mk22YldQ== +=rM6M +-----END PGP SIGNATURE-----
