Loading vulnerability…
Cross-profile OAuth token reuse in Apache Camel
CVE-2026-94386 affects Apache Camel's camel-oauth component from version 4.19.0 up to, but excluding, 4.22.2. OAuthClientCredentialsTokenResolver stores OAuth 2.0 client credentials tokens in a static cache shared across resolver instances and CamelContext instances within the same JVM. The cache key includes only the token endpoint and client ID, omitting the requested scope and client secret. Consequently, profiles sharing an endpoint and client ID can receive another profile's cached token despite having different scopes or secrets. Caching is enabled by default. This can disclose bearer tokens to unintended receiving services and cause requests to carry authority inconsistent with the calling profile's configuration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Cross-profile token reuse can expose a token with broader permissions than the requesting profile was configured to obtain. If the identity provider derives token audience from scope, a token intended for one service can be sent to another. A profile configured with a different client secret can also receive a token obtained using another profile's secret without authenticating with its own credentials. A hostile or compromised receiving service can replay the disclosed bearer token within its authorized scope, potentially compromising confidentiality and integrity. The reported CVSS 3.1 score is 4.8, with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
If you can’t patch tonight, do this now.
Disable token caching for affected profiles by setting camel.oauth.NAME.cache-tokens=false for each affected named profile, or camel.oauth.cache-tokens=false for an affected default profile. Each resolution then obtains a token using that profile's own scope and secret, at the cost of an additional token request per resolution. Alternatively, register separate identity-provider clients, with distinct client IDs, for profiles requiring different scopes or secrets.
Patch, then assume compromise.
Upgrade to Apache Camel 4.23.0, or to 4.22.2 when remaining on the 4.22.x release stream. The corrected cache key includes the token endpoint, client ID, a SHA-256 fingerprint of the client secret, and requested scope, separating tokens for profiles with different authorization configurations without retaining raw secrets in the cache. Versions 4.19.x through 4.21.x are end of life and will not receive fixes. Versions 4.18.x and earlier are unaffected because they do not include the client credentials token resolver.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.