CVE-2026-94386
Description
A flaw was found in Apache Camel's OAuth component. The token resolver improperly caches and shares OAuth access tokens across different authentication profiles that use the same endpoint and client identifier, without accounting for differences in requested scopes or credentials. As a result, outbound requests may send tokens with broader or unintended permissions, allowing unintended recipient services to access sensitive tokens and unauthorized resources.
Statement
This vulnerability is rated as Moderate severity because it requires a specific multi-profile configuration within the integration runtime to occur, rather than exposing systems unconditionally. In typical Red Hat environments utilizing Apache Camel integration services, the flaw manifests only when multiple OAuth client configurations share an identical authorization endpoint and client ID while requesting differing permissions or scopes. Although cached authorization tokens may inadvertently be dispatched to third-party endpoints or reused across services with broader privileges, the issue cannot be triggered directly by external untrusted callers without these coexisting configurations.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
