CVE-2026-85317
Description
A flaw was found in the Apache Camel HTTP component. The OAuth2 authentication token cache incorrectly shares stored tokens across different endpoints because key authorization attributes, such as requested permissions and target service destinations, are omitted from the cache key. In multi-endpoint deployments running within the same Java Virtual Machine (JVM), an endpoint can reuse an inappropriate cached token, allowing outgoing requests to operate with broader authority than intended or exposing tokens to unauthorized parties.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires a specific configuration where multiple outbound HTTP endpoints run inside the same Java process with divergent OAuth2 credential requirements. In typical microservice deployments where integrations communicate with a single downstream identity provider and uniform scopes, the shared cache does not create cross-tenant exposure. Risk is primarily restricted to consolidated integration runtimes where different endpoints concurrently target multiple authorization servers, resource indicators, or scopes, potentially allowing an outgoing call to present an overly privileged or misplaced bearer token.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
