CVE-2026-94386

Apache Camel OAuth cache can reuse another AI connector profile’s token

Apache Software Foundation · Apache Camel camel-oauth and dependent AI connectors

First documented disclosure · Review checkpoint

Summary

OAuth profiles with the same endpoint and client ID can receive a token obtained using another profile’s scope or secret.

Severity and exploitation evidence

Medium · 4.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A JVM-wide token cache omitted scope and client-secret identity from its key.

Conditions required

At least two trusted deployment profiles share endpoint and client ID but differ in scope or secret, with caching enabled. The advisory names OpenAI, LangChain4j, Hugging Face, Docling, A2A, Spring AI and watsonx connectors. Untrusted input does not configure the cache.

Potential impact

An outbound call may carry broader authority or a different service audience than intended. A hostile recipient could replay the misplaced token within its scope.

Affected versions and configurations

org.apache.camel:camel-oauth >=4.19.0 and <4.22.2. Version 4.18.x and earlier did not contain this resolver.

Fix and mitigation status

4.22.2 and 4.23.0; the affected 4.19.x–4.21.x lines are end of life.

Practical next steps

Upgrade to 4.22.2 or 4.23.0. Pending upgrade, disable token caching on colliding profiles or use a different identity-provider client ID for each scope/secret profile.

Operating lesson

Credential caches must include every security-relevant input to token issuance.

Evidence and limits

September 21 public fix PR #26681 explicitly describes the same missing scope/credential cache identity. The formal vendor advisory is October 22 and CNA publication October 26. This is a conditional connector-dependency flaw, not a claim that all listed AI services are breached.

Sources