oscerd/cve-2026-53913
PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.
Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:
| Runtime | Directory | Stack |
|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.2.0 + camel-spring-boot 4.18.2 |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.36.0 + Camel Quarkus 3.36.0 (bundles Camel 4.20.0) |
Both are affected versions (fixed in 4.18.3 / 4.21.0), and both demonstrate the identical defect:
KeycloakSecurityPolicy, in its documented "Basic Setup" with no required roles/permissions, never verifies the
presented token — the token receives only a non-null check. Any garbage or forged bearer value reaches the
protected route, and when that route forwards to a code-execution sink the result is an unauthenticated remote
code execution (CWE-287 / CWE-306 / CWE-636). This is the most severe issue in the 2026 batch. (The Spring Boot
variant drives the exec component; the Quarkus variant drives an equivalent processor.)
Each subdirectory is a self-contained project with its own Dockerfile, docker-compose.yml, and README. In
short, for either:
cd camel-spring-boot # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
| Property | Value |
|---|---|
| Component | camel-keycloak (Spring Boot: camel-keycloak-starter; Quarkus: camel-quarkus-keycloak) |
| CWE | CWE-287 (Improper Authentication) / CWE-306 (Missing Authentication) / CWE-636 (Not Failing Securely) |
| Impact | Pre-authentication bypass; unauthenticated RCE when the protected route forwards to a code-exec sink |
| Affected Versions | From 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0 |
| Fixed Versions | 4.18.3, 4.21.0 |
| JIRA | CAMEL-23738 (PR apache/camel#23958) |
| Credit | Lidor Ben Shitrit (Novee Security) |
These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.