CVE-2026-94386

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.19.0 through 4.22.1

Description The OAuth component contains an issue where the OAuthClientCredentialsTokenResolver stores OAuth 2.0 bearer tokens in a static cache shared across all resolver instances and CamelContext within the JVM. The cache is keyed only by the token endpoint and the client ID, ignoring the client secret and requested scope. Consequently, if multiple profiles share the same token endpoint and client ID but use different scopes or secrets, they may receive a token intended for a different profile. This can result in outbound requests carrying tokens with broader authority than intended or tokens meant for a different service. A compromised or hostile service receiving such a token could potentially replay it within its scope.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.2 for those on the 4.22.x release stream. For versions 4.19.0 through 4.21.x, migrate to a supported release as these versions have reached end of life. As a temporary mitigation, disable token caching for profiles sharing a token endpoint and client ID by setting camel.oauth.NAME.cache-tokens=false for named profiles or camel.oauth.cache-tokens=false for the default profile. Alternatively, register a unique client at the identity provider for each profile requiring a different scope or client secret to ensure no two profiles share a client ID.