External risk intelligence

Apache Camel Keycloak Component Session Expiration Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-46455

The vulnerability exists in an integration component often used to authenticate inbound requests in web services, APIs, and microservices. Because these applications are commonly deployed as internet-facing endpoints or gateways that handle external traffic and rely on token-based authentication, the vulnerable surface is frequently exposed to the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a security flaw in a component of Apache Camel that handles authentication, specifically related to how it validates security tokens. The vulnerability allows for the acceptance of expired or not-yet-valid security tokens, which could potentially undermine authentication for requests relying on this component. The primary concern is to confirm if this component is in use and exposed to external traffic.

Token validation flaw impacts authentication.
Potential for unauthorized access if exposed.
Confirm relevance and review exposure.

Attack Path

How an attacker could exploit the issue

An attacker could send an expired or not-yet-valid access token to an application using the Apache Camel Keycloak Component. The component incorrectly verifies the token, accepting it as legitimate. This could allow an attacker to bypass authentication and gain unauthorized access to application routes.

Unauthenticated network access required.
Token validation bypass.
Unauthorized access to application routes.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an insufficient session expiration vulnerability in Apache Camel Keycloak Component could allow attackers to use access tokens beyond their intended validity window. This means that routes relying on this helper to authenticate inbound requests may accept expired or not-yet-valid tokens, potentially granting unauthorized access.

Access tokens could be reused.
Expired tokens may be accepted as valid.
Unauthorized access to routes may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects systems using Apache Camel's Keycloak integration for authentication, potentially impacting application owners and platform teams responsible for identity and access management. The immediate priority is to locate all instances of the affected component, assess their exposure and business criticality, and identify the specific owner accountable for remediation. Planning should then focus on the most effective fix, considering a timely upgrade or alternative validation strategies to mitigate risk.

Identify Camel Keycloak integration usage.
Verify external access and business criticality.
Plan upgrade or implement workarounds.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Apache Camel Keycloak component?

Apache Camel is an integration framework used to connect various software applications and systems. The Keycloak component specifically acts as a security helper, allowing Camel routes to authenticate incoming requests by verifying security tokens against a Keycloak identity provider. It ensures that services connected via Camel can securely manage user identities and access control.

What is the vulnerability in CVE-2026-46455?

This flaw is an Insufficient Session Expiration issue, categorized as CWE-613. It occurs because the component verifies the signature and issuer of a token but fails to check its active status. Specifically, it ignores the built-in checks for expiration and 'not-before' timestamps. As a result, the software treats expired or inactive tokens as legitimate, potentially allowing access beyond the token's intended lifetime.

How does an attacker trigger this vulnerability?

An attacker triggers this by providing an expired or not-yet-valid access token to an application route that relies on the faulty KeycloakSecurityHelper. The helper accepts the token as valid because it lacks the necessary expiration checks. This bug is not triggered by valid, current tokens, nor is it dependent on specific user privileges, as it bypasses the fundamental validity window check for any provided token.

Is my system at risk for this CVE?

You should be concerned if your applications use the Apache Camel Keycloak component to authenticate inbound requests. According to Halo Surface Signal, this vulnerability is particularly relevant for internet-facing endpoints, APIs, or gateways that rely on this component for token-based authentication. If your services are exposed to the public internet, they are at higher risk because they are more likely to receive and process malicious tokens from external sources.

What are the first steps to fix this?

The primary recommendation is to upgrade to Apache Camel version 4.21.0 or version 4.18.3, depending on your current release stream. If an immediate upgrade is not possible, you must manually enforce token validity by checking expiration and 'not-before' claims within your Camel routes before trusting the token. Additionally, ensure that any upstream gateways or resource servers are performing their own strict token validation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.