This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 15cceba57560f6fcf1e899105b3dba41e528051e Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 10:36:37 2026 +0200 Added CVE-2026-94386 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-94386.md | 25 +++++++++++++++++++++ content/security/CVE-2026-94386.txt.asc | 39 +++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/content/security/CVE-2026-94386.md b/content/security/CVE-2026-94386.md new file mode 100644 index 00000000..b2708fba --- /dev/null +++ b/content/security/CVE-2026-94386.md @@ -0,0 +1,25 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-94386" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-94386.html +draft: false +type: security-advisory +cve: CVE-2026-94386 +severity: MEDIUM +summary: "Camel-OAuth: Cross-scope token reuse via an under-keyed JVM-global client credentials token cache" +description: "OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that authenticate their outbound calls with a named OAuth profile, such as camel-openai, camel-langchain4j-agent, camel-huggingface, camel-docling, camel-a2a, camel-spring-ai-chat and the IBM watsonx components, and of applications that call the OAuthClientAuthenticationFactory SPI directly. It kept the tokens it obtained in a static cache sha [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. The 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, disable token caching on every OAuth profile that shares a token endpoint and client ID with a [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.19.0 before 4.22.2." +fixed: 4.22.2 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24872 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26681 (commit 5e896b2df24bf80ad4a78be1f8a708f71d91aa16), and backported to camel-4.22.x in https://github.com/apache/camel/pull/27779 (commit b2d9957bcbcf87bd5e59992fec45231876c645ed). + +The cache key now holds every input of the token request: the token endpoint, the client ID, a SHA-256 fingerprint of the client secret, so that the raw secret is not kept in the static cache, and the requested scope. An absent, empty or blank scope counts as one value, because each of them leaves the scope parameter out of the request; any other scope is matched exactly. Profiles that agree on all four still share a token across resolver instances, while profiles that differ in credenti [...] + +The client credentials token resolver and its cache were added in 4.19.0 by https://issues.apache.org/jira/browse/CAMEL-23093, which let other components obtain bearer tokens through camel-oauth with a named profile, and the cache was keyed on the token endpoint and client ID from the start, so the affected range begins at that release. The 4.18.x line and earlier do not contain the resolver and are not affected, although camel-oauth itself is older. + +This is the same class of defect as CVE-2026-85317, in which the OAuth2 client token cache of camel-http was keyed on fewer fields than shape the token. The two caches are separate code and that fix did not touch camel-oauth; here, unlike in camel-http, token caching is enabled by default, and the key also left out the client secret. The issue is also distinct from CVE-2026-80312 and CVE-2026-84178, which concerned the inbound processors of camel-oauth: 4.22.1, which fixes those two, is [...] diff --git a/content/security/CVE-2026-94386.txt.asc b/content/security/CVE-2026-94386.txt.asc new file mode 100644 index 00000000..9389761f --- /dev/null +++ b/content/security/CVE-2026-94386.txt.asc @@ -0,0 +1,39 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-94386" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-94386.html +draft: false +type: security-advisory +cve: CVE-2026-94386 +severity: MEDIUM +summary: "Camel-OAuth: Cross-scope token reuse via an under-keyed JVM-global client credentials token cache" +description: "OAuthClientCredentialsTokenResolver obtains OAuth 2.0 bearer tokens through the client credentials grant on behalf of the components that authenticate their outbound calls with a named OAuth profile, such as camel-openai, camel-langchain4j-agent, camel-huggingface, camel-docling, camel-a2a, camel-spring-ai-chat and the IBM watsonx components, and of applications that call the OAuthClientAuthenticationFactory SPI directly. It kept the tokens it obtained in a static cache sha [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. The 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, disable token caching on every OAuth profile that shares a token endpoint and client ID with a [...] +credit: "This issue was discovered by Andrea Cosentino from Apache Software Foundation" +affected: "From 4.19.0 before 4.22.2." +fixed: 4.22.2 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24872 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26681 (commit 5e896b2df24bf80ad4a78be1f8a708f71d91aa16), and backported to camel-4.22.x in https://github.com/apache/camel/pull/27779 (commit b2d9957bcbcf87bd5e59992fec45231876c645ed). + +The cache key now holds every input of the token request: the token endpoint, the client ID, a SHA-256 fingerprint of the client secret, so that the raw secret is not kept in the static cache, and the requested scope. An absent, empty or blank scope counts as one value, because each of them leaves the scope parameter out of the request; any other scope is matched exactly. Profiles that agree on all four still share a token across resolver instances, while profiles that differ in credenti [...] + +The client credentials token resolver and its cache were added in 4.19.0 by https://issues.apache.org/jira/browse/CAMEL-23093, which let other components obtain bearer tokens through camel-oauth with a named profile, and the cache was keyed on the token endpoint and client ID from the start, so the affected range begins at that release. The 4.18.x line and earlier do not contain the resolver and are not affected, although camel-oauth itself is older. + +This is the same class of defect as CVE-2026-85317, in which the OAuth2 client token cache of camel-http was keyed on fewer fields than shape the token. The two caches are separate code and that fix did not touch camel-oauth; here, unlike in camel-http, token caching is enabled by default, and the key also left out the client secret. The issue is also distinct from CVE-2026-80312 and CVE-2026-84178, which concerned the inbound processors of camel-oauth: 4.22.1, which fixes those two, is [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ +QQBIbAf+Ic5m/vClqHq33G8tmBz6t47ngXITq+B1ZUiBjMICbsCe6Mx/+0Zj3rlR +VAgbTidVH4PoLm0DUoUkvy2yXChvgSxfqN+3AB/EoOaJSNyTE8ncDesDWA93PaVW +rpoSk7Q7sznW10FRwGIGxLc51gFbLfnlN/wgvWRDXrDiBsuishFDuWT4imlzMmMv +NhQyEx4Ldz2HAlBVXJySB7cywIFE/vQe/FVMp5ERb8tcpYu5ArLndk48S2aGP9gK +h+pH+SKDPqp5z2jkEmugjBk4cJ5bJul/x2wbWQw+Di7MsylzJnPgMbembghDjdsm +9SiJGq56h2K4rKf9xvpMXwb8Jy6qLg== +=G/r9 +-----END PGP SIGNATURE-----
