CVE-2026-46455 camel vulnerability
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default checks are installed only when withDefaultChecks() is called - so the built-in IS_ACTIVE predicate, which validates the token's exp (expiration) and nbf (not-before) claims, is never applied. As a result the helper verifies the token signature, subject and issuer but does not enforce the token's validity window: an access token that is expired, or not yet valid, is accepted as valid. Routes that rely on this helper to authenticate inbound requests therefore accept access tokens that are outside their intended lifetime. This issue affects Apache Camel: from 4.18.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes KeycloakSecurityHelper.parseAndVerifyAccessToken include the TokenVerifier.IS_ACTIVE check so that expired or not-yet-valid access tokens are rejected, aligning the helper with Keycloak's default check set. For deployments that cannot upgrade immediately, enforce token expiration outside the helper - for example validate the access token's exp/nbf claims in the route before trusting it, keep Keycloak access-token lifetimes short, and ensure any upstream gateway or resource server also validates the token validity window.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-46455 affects Apache Camel Keycloak. Upgrade Apache Camel on the deployed branch to a fixed release (4.18.3, 4.21.0) and review routes that expose this component to external or user-controlled messages. Affected ranges in the local NVD record are 4.18.0 through before 4.18.3; 4.19.0 through before 4.21.0.
- Inventory every service, integration route, container image, and build manifest that includes Apache Camel Keycloak or transitive Camel modules related to Keycloak.
- Compare each deployed Camel version with the affected ranges for CVE-2026-46455; treat 4.0.x-4.14.7, 4.15.x-4.18.2, and 4.19.x-4.20.x as needing an upgrade when the component is present.
- Upgrade to the fixed Camel release for the active branch: 4.14.8, 4.18.3, 4.21.0, or a later vendor-supported release.
- Rebuild application artifacts and container images from a clean dependency lockfile so no vulnerable Camel module remains through transitive dependencies.
- Harden exposed routes by filtering user-controlled Camel headers and component-specific control headers before data reaches Camel producers or internal route logic.
- Rotate credentials or integration tokens if logs, routing headers, backend endpoints, or message contents may have been exposed or redirected through the vulnerable route.
- Deploy first to staging, run regression tests for the impacted route, then promote to production with monitoring for routing errors, authorization failures, SSRF attempts, and unexpected message destinations.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm dependency output shows Apache Camel 4.18.3, 4.21.0 or a later fixed release in every affected application.
- Run route-level tests that replay malicious or unexpected headers and verify they are removed, ignored, or rejected before reaching Camel internals.
- Check application logs after deployment for exceptions, leaked stack traces, SSRF indicators, unauthorized backend operations, or unexpected route destinations.
- Open the generated Fixnx page and confirm the canonical URL ends with camel-cve-2026-46455.
- Re-run sitemap validation and confirm camel-cve-2026-46455 appears once in sitemap.xml with the full CVE-2026-46455 suffix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-46455?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.