SB2026091066 - Multiple vulnerabilities in Red Hat build of Keycloak 26.4

Description

This security bulletin contains information about 11 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-3047)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass disabled SAML client restrictions and establish a realm SSO session.

The vulnerability exists due to improper enforcement of disabled client status in the SAML broker when processing IdP-initiated broker logins. A remote user can authenticate through an external identity provider to bypass disabled SAML client restrictions and establish a realm SSO session.

The disabled SAML client must be configured as an IdP-initiated broker landing target.

2) Improper access control (CVE-ID: CVE-2026-3009)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to authenticate through a disabled identity provider.

The vulnerability exists due to improper enforcement of disabled identity provider status in the IdentityBrokerService.performLogin endpoint when processing broker login requests. A remote user can submit a manually constructed request to the broker login endpoint to authenticate through a disabled identity provider.

Exploitation requires a valid session_code and tab_id obtained from a standard login attempt.

3) Improper access control (CVE-ID: CVE-2026-2603)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to authenticate users into the realm through a disabled SAML identity provider.

The vulnerability exists due to improper enforcement of disabled identity provider status in the SAML broker callback endpoint when processing IdP-initiated broker logins. A remote attacker can submit a SAML response through the broker callback endpoint to authenticate users into the realm through a disabled SAML identity provider.

4) Improper Validation of Specified Type of Input (CVE-ID: CVE-2026-2092)

CWE-ID: CWE-1287 - Improper Validation of Specified Type of Input

CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to gain unauthorized access and disclose sensitive information.

The vulnerability exists due to improper validation of specified type of input in the SAML broker endpoint when processing encrypted assertions in an unsigned SAML response. A remote user can craft a malicious SAML response containing an encrypted assertion for an arbitrary principal to gain unauthorized access and disclose sensitive information.

Exploitation requires a valid signed SAML assertion.

5) Improper Authorization (CVE-ID: CVE-2026-2733)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to obtain authentication tokens for a disabled Docker registry client.

The vulnerability exists due to improper authorization in the Docker v2 authentication endpoint when processing token requests for an administratively disabled Docker registry client. A remote privileged user can use previously valid credentials to obtain authentication tokens for a disabled Docker registry client.

6) Improper handling of highly compressed data (CVE-ID: CVE-2026-2575)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in SAMLRequest decompression when processing a crafted SAMLRequest. A remote attacker can send a specially crafted SAMLRequest to cause a denial of service.

7) Insufficient Session Expiration (CVE-ID: CVE-2026-1190)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to extend the validity period of SAML responses.

The vulnerability exists due to missing timestamp validation in Keycloak's SAML brokering functionality when processing SAML responses containing SubjectConfirmationData. A remote attacker can delay expiration of a SAML response to extend the time it is considered valid.

User interaction is required.

8) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-0707)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to incorrect behavior order in Keycloak authorization processing when parsing and canonicalizing input. A remote user can submit crafted input to bypass authorization checks.

9) Use of uninitialized resource (CVE-ID: CVE-2025-15281)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to usage of uninitialized resources when calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND. A remote attacker can pass specially crafted data to the application, trigger an uninitialized usage of resources and crash the application. 

10) Integer overflow (CVE-ID: CVE-2026-0861)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the memalign functions, such as memalign(), posix_memalign(),  aligned_alloc(). A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

11) Use of uninitialized resource (CVE-ID: CVE-2026-0915)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of uninitialized resources when calling getnetbyaddr() or getnetbyaddr_r() functions with a configured nsswitch.conf and "net==0" in _nss_dns_getnetbyaddr_r. A remote attacker can trick the victim to initiate queries and force the library to leak contents to the configured DNS resolver. 

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2026:3948