Loading vulnerability…
CVE-2026-53913 is an improper authentication / fail-open flaw in the Apache Camel Keycloak component (camel-keycloak). In KeycloakSecurityPolicy, route protection is enforced through KeycloakSecurityProcessor.beforeProcess(), which first checks only for the presence of an access token, then performs role validation only if requiredRoles is non-empty, and permission validation only if requiredPermissions is non-empty. Cryptographic bearer-token verification is performed exclusively inside those role and permission validation paths. Because the documented default/basic setup leaves both requiredRoles and requiredPermissions empty, those checks are skipped and token verification never occurs. In that configuration, any non-null Authorization: Bearer value—including an arbitrary string or a forged/unsigned JWT—is accepted, with no signature, issuer, expiry, or introspection validation, and the request is allowed to reach the protected route. The issue affects Apache Camel versions 4.15.0 before 4.18.3 and 4.19.0 before 4.21.0.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a genuine self-contained Java/Spring Boot proof-of-concept for CVE-2026-53913, a fail-open authentication bypass in Apache Camel's camel-keycloak component. The project contains 10 files, with the main logic in four Java classes: Application.java boots the app, KeycloakPolicyConfig.java creates a KeycloakSecurityPolicy in the vulnerable 'Basic Setup' with no required roles/permissions, VictimRoute.java exposes a Camel platform-http admin route at /admin/run and forwards successful requests into the Camel exec component, and ExploitController.java acts as the attacker driver by sending requests with no token, a garbage bearer token, and a forged unsigned JWT. The exploit capability is authentication bypass leading to privileged route access and command execution. The vulnerable condition is that token verification in camel-keycloak only occurs when required roles or permissions are configured; with both left empty, any non-null bearer token passes. In this PoC, reaching the protected route causes `/bin/sh -c "id > /tmp/pwned"` to run, proving unauthenticated RCE impact through a fixed command. The exploit is operational rather than just demonstrative detection because it actively triggers the vulnerable route and verifies success via the marker file. Fingerprintable endpoints include the local exploit trigger `/exploit/attack`, the targeted admin endpoint `http://localhost:8080/admin/run`, the Camel route `platform-http:/admin/run`, the configured Keycloak URL `https://keycloak.internal.example/auth`, and the marker/output file `/tmp/pwned`. The repository also includes Dockerfile and docker-compose.yml for easy reproduction, pom.xml pinning vulnerable Camel version 4.18.2, and application.properties setting port 8080. Overall, the repository's purpose is to reproduce and clearly demonstrate that a non-null garbage or forged bearer token can bypass authentication and reach a privileged Camel exec sink when camel-keycloak is misconfigured in its documented basic mode on affected versions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.