CVE-2026-85317: CWE-524 Use of Cache Containing Sensitive Information in Apache Software Foundation Apache Camel

Apache Camel versions >=4.0.0 <4.18.5 and >=4.19.0 <4.22.1 have a CWE-524 Use of Cache Containing Sensitive Information vulnerability in the OAuth2 client token cache. The cache key used to store tokens globally in the JVM omitted fields that define token authorization scope, resource indicator, and token endpoint. This caused different OAuth2 endpoints differing only in these fields to share cached tokens, potentially allowing an endpoint to use a token with broader permissions or a token issued for a different authorization server. The vulnerability requires a deployment with multiple OAuth2 endpoints differing in these fields. The issue is resolved by including all relevant fields in the cache key in Apache Camel 4.18.5, 4.22.1, and 4.23.0. As a temporary mitigation, endpoints with differing OAuth2 parameters should run in separate JVMs to avoid cache sharing.

The vulnerability can lead to an endpoint receiving an OAuth2 token with broader authority than configured or a token intended for a different authorization server. This could result in unauthorized access or privilege escalation within the affected application. However, exploitation requires a specific deployment scenario with multiple OAuth2 endpoints differing in scope, resource indicator, or token endpoint. The CVSS 3.1 base score is 4.8 (medium severity), reflecting limited impact and attack complexity.

Upgrade affected Apache Camel versions to 4.18.5 (for 4.18.x LTS stream), 4.22.1 (for 4.22.x LTS stream), or 4.23.0 and later, where the cache key includes all fields shaping the token, preventing cache sharing between differing endpoints. For deployments unable to upgrade immediately, run OAuth2 endpoints that differ in scope, resource indicator, or token endpoint in separate JVMs to isolate their caches and prevent token sharing.