Apache Camel's Integration Routes Do Not Advertise Their Authorization Policy
Apache Camel is an integration runtime embedded in Java services. The externally visible endpoint may belong to the business application rather than to a standalone Camel server. That makes product-name discovery incomplete by design.
ZoomEye count-only queries used sub_type=all, page 1 and page size 1 on 2026-11-13 between 07:40 and 07:43 Asia/Shanghai.
| Query | Matching assets |
|---|---|
app="Apache Camel" |
0 |
title="Apache Camel" |
15 |
Those results do not measure the number of deployed Camel routes. They show that the runtime usually sits behind an application identity that a crawler can see.
The authorization issue
CVE-2026-53913 affects camel-keycloak from 4.15.0 before 4.18.3 and from 4.19.0 before 4.21.0. The fixed versions are 4.18.3 and 4.21.0.
KeycloakSecurityPolicy rejects a request with no bearer token. It then validates roles only when requiredRoles is non-empty and permissions only when requiredPermissions is non-empty. The actual token signature, issuer and expiry checks live inside those optional branches.
The default policy has both lists empty. Any non-null bearer value, including an arbitrary string or forged unsigned JWT, can reach the route without a Keycloak request.
Build a route inventory
Search source repositories, Java dependencies and application manifests for KeycloakSecurityPolicy and camel-keycloak. Record the Camel version, route path, role requirements and permission requirements.
Identify routes that can invoke process, file, database or messaging producers. Those routes carry more risk than a read-only transformation.
External ZoomEye results can identify business applications that may embed Camel, but route configuration comes from the application owner and deployment artifacts.
Restrict and test
Upgrade to 4.18.3 or 4.21.0. If the upgrade must wait, configure a non-empty role or permission on every policy, set allowTokenFromHeader to false when header tokens are not expected, and add framework-level authentication.
Test invalid signatures, expired tokens and tokens from the wrong issuer. Confirm that each is rejected before a route producer executes.
Evidence
Store the query total and time with the integration inventory. Keep the unverified external candidate list separate from route-level findings. For this issue, the decisive evidence is the policy configuration and a request test, not a product title.
Top comments (0)