CVE-2026-25747 Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

CVE-2026-25747

CVE-2026-25747 describes a Deserialization of Untrusted Data vulnerability in the Apache Camel LevelDB component. The issue stems from the DefaultLevelDBSerializer using java.io.ObjectInputStream to read from the LevelDB aggregation repository without ObjectInputFilter or class-loading restrictio...

CVE-2026-25747 Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. ...

CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552

Summary: CVE-2026-23552 describes an authentication bypass in Apache Camel’s Camel-Keycloak integration via the KeycloakSecurityPolicy. Affected software: Apache Camel versions 4.15.0 through 4.17.9 (per the CVE entry and related Nessus/Red Hat entries). Root cause (as stated): The KeycloakSecuri...

CVE-2026-23552

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

Apache Camel 安全漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern EIP, developed by the Apache Foundation in the United States. This framework provides implementations of Java objects following the EIP pattern, and routing and mediation rules are configured through...

Apache Camel 安全漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern from the Apache Foundation in the United States. This framework provides implementations of Java objects following the Enterprise Integration Pattern and allows routing and mediation rules to be...

PT-2026-20652

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.17.9 Description The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This allows a token issued by one Keycloak realm to be silentl...

PT-2026-20653

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.10.0 through 4.10.7 Apache Camel versions 4.14.0 through 4.14.4 Apache Camel versions 4.15.0 through 4.17.9 Description The LevelDB component in Apache Camel contains a flaw where it deserializes data from the LevelDB...

Exploit for CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloa...

Exploit for CVE-2026-25747

LevelDB Deserialization Vulnerability Reproducer This project...

CVE-2025-66169

A flaw was found in the Apache Camel camel-neo4j component. A remote attacker can exploit this Cypher Injection vulnerability to perform unauthorized data modification or execute arbitrary database queries. This could lead to a compromise of data integrity within the Neo4j database...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14.2.P1 for Spring Boot release.

Red Hat build of Apache Camel 4.14.2 for Spring Boot patch 1 release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

org.apache.camel.springboot:camel-neo4j-starter (>=4.15.0 <=4.16.0) potentially affected by CVE-2025-66169 via org.apache.camel:camel-neo4j (>=4.15.0 <=4.16.0)

org.apache.camel:camel-neo4j MAVEN version =4.15.0, =4.15.0, =4.16.0 Source cves: CVE-2025-66169 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-14930769...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the process that handles Cypher queries. An attacker can execute arbitrary Cypher commands by injecting malicious input into the query construction process. Remediation...

org.apache.camel.springboot:camel-neo4j-starter (>=4.14.0 <=4.14.2) potentially affected by CVE-2025-66169 via org.apache.camel:camel-neo4j (>=4.14.0 <=4.14.2)

org.apache.camel:camel-neo4j MAVEN version =4.14.0, =4.14.0, =4.14.2 Source cves: CVE-2025-66169 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-14930769...

org.apache.camel.karaf:camel-neo4j (>=4.10.3 <=4.10.7), org.apache.camel.springboot:camel-neo4j-starter (>=4.10.0 <=4.10.7) potentially affected by CVE-2025-66169 via org.apache.camel:camel-neo4j (>=4.10.0 <=4.10.7)

org.apache.camel:camel-neo4j MAVEN version =4.10.0, =4.10.3, =4.10.0, =4.10.7 Source cves: CVE-2025-66169 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-14930769...