SB2026091143 - Multiple vulnerabilities in Red Hat build of Keycloak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091143

SB2026091143 - Multiple vulnerabilities in Red Hat build of Keycloak

Published: September 11, 2026

Security Bulletin ID SB2026091143
CSH Severity
High
Patch available
YES
Number of vulnerabilities 19
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 11% Medium 47% Low 42%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 19 vulnerabilities.


1) Input validation error (CVE-ID: CVE-2026-16071)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and import unauthorized users into local storage.

The vulnerability exists due to improper input validation in the LDAP storage provider user search functionality when processing a specific LDAP entry distinguished name. A remote user can perform a search using a crafted LDAP entry DN to disclose sensitive information and import unauthorized users into local storage.

The issue occurs when a delegated administrator performs the search, allowing lookups outside the configured search boundary.


2) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to instantiate arbitrary classes.

The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.

Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.


4) Input validation error (CVE-ID: CVE-2026-40984)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in HTTP server instrumentations when handling specially crafted HTTP requests. A remote attacker can send a specially crafted HTTP request to cause a denial of service.

The issue affects applications only when one or more HTTP server instrumentations are configured and metrics are recorded through the instrumentation.


5) Input validation error (CVE-ID: CVE-2026-40983)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ObservationGrpcServerInterceptor when handling specially crafted gRPC requests. A remote attacker can send a specially crafted gRPC request to cause a denial of service.

The issue is exposed only when observations are recorded and metrics are output through DefaultMeterObservationHandler or a similarly behaving custom ObservationHandler.


6) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-16443)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to a user account.

The vulnerability exists due to improper verification of cryptographic signature in the SAML metadata import functionality of the keycloak-services component when importing identity provider metadata that lacks specific usage attributes for keys. A remote attacker can forge a SAML response to gain unauthorized access to a user account.

Exploitation requires knowledge of the target user\'s external identifier.


7) Origin validation error (CVE-ID: CVE-2026-16442)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify data.

The vulnerability exists due to origin validation error in the SAML IdP-initiated broker login flow when processing IdP-initiated broker login requests. A remote attacker can send a specially crafted SAML IdP-initiated broker login request to disclose sensitive information and modify data.


8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-16308)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in MultipartParser when handling multipart/form-data requests. A remote attacker can send a specially crafted multipart/form-data request with an arbitrarily large MIME part-header section to cause a denial of service.

The issue affects endpoints that accept multipart/form-data, and a single request can exhaust the JVM heap and crash the application with OutOfMemoryError before any application code runs.


9) Input validation error (CVE-ID: CVE-2026-16102)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to forge administrative roles in their access token.

The vulnerability exists due to improper input validation in the default Dynamic Client Registration policy when processing User Property mappers with claim paths targeting sensitive internal claim locations. A remote user can use a limited Initial Access Token and write values to sensitive internal claim locations to forge administrative roles in their access token.

This can lead to takeover of other clients, theft of confidential secrets, and potential full administrative control over the realm.


10) Resource exhaustion (CVE-ID: CVE-2026-16100)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in user-event metrics recording when processing failed account operations with request-controlled error text. A remote user can submit crafted requests with unique input values to cause a denial of service.

Only instances with metrics enabled are vulnerable.


11) Direct Request ('Forced Browsing') (CVE-ID: CVE-2026-11986)

CWE-ID: CWE-425 - Direct Request ('Forced Browsing')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to remove highly privileged roles from other users or groups.

The vulnerability exists due to missing granular authorization checks in the admin-ui-ext bulk role-mapping-delete endpoints when deleting role mappings. A remote privileged user can use the bulk role-removal endpoints to remove highly privileged roles from other users or groups.


12) Improper Authorization (CVE-ID: CVE-2026-15573)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authorization and access restricted areas.

The vulnerability exists due to improper access control in the PathMatcher component when handling request paths containing unnormalized URIs. A remote user can send a specially crafted request with a trailing slash or matrix parameters to bypass authorization and access restricted areas.

The issue can cause less restrictive security policies to be applied than intended, including exposure of administrative areas.


13) Type Confusion (CVE-ID: CVE-2026-15572)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain full administrative access to the Keycloak realm.

The vulnerability exists due to access of resource using incompatible type in the Dynamic Client Registration \"Allowed Protocol Mapper Types\" policy when processing client update requests. A remote user can register an allowed mapper type with a malicious configuration and then swap it to a restricted high-privilege mapper type to gain full administrative access to the Keycloak realm.

Exploitation requires client registration privileges.


14) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-9798)

CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass brute-force protection for a locked user account.

The vulnerability exists due to improper authentication in the Client-Initiated Backchannel Authentication flow when processing CIBA authentication requests for locked user accounts. A remote attacker can initiate a CIBA authentication request for a locked user account to bypass brute-force protection for a locked user account.

CIBA must be explicitly enabled and configured, and the user must approve the authentication request on their device.


15) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-9793)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to submit unauthorized claims in the OIDC authorization flow.

The vulnerability exists due to improper verification of cryptographic signatures in JWE-encrypted request object processing when processing a JWE-encrypted request object with raw JSON plaintext. A remote attacker can submit a JWE-encrypted request object with raw JSON plaintext to submit unauthorized claims in the OIDC authorization flow.


16) Improper Validation of Consistency within Input (CVE-ID: CVE-2026-9689)

CWE-ID: CWE-1288 - Improper Validation of Consistency within Input

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a client application to process attacker-controlled OIDC response parameters.

The vulnerability exists due to HTTP parameter pollution in OIDC redirect URI processing when processing a crafted authorization URL. A remote attacker can craft an authorization URL with duplicate response parameters to cause a client application to process attacker-controlled OIDC response parameters.

Exploitation requires a broad redirect URI configuration, a client application that uses first-wins handling for duplicate query parameters, and user interaction to open the crafted URL.


17) Insufficient Granularity of Access Control (CVE-ID: CVE-2026-14615)

CWE-ID: CWE-1220 - Insufficient Granularity of Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose restricted group metadata and attributes.

The vulnerability exists due to an improper conditional check in group retrieval logic in Keycloak administrative services when retrieving child groups through a parent group. A remote user can request child groups through a parent group to disclose restricted group metadata and attributes.

Fine-Grained Admin Permissions v2 must be enabled.


18) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-14614)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify the contents of security tokens issued to end users.

The vulnerability exists due to a missing authorization check on referenced client scopes in the ClientResource component when assigning client scopes through the admin REST API. A remote user can attach or remove hidden client scopes to modify the contents of security tokens issued to end users.

Fine-Grained Admin Permissions v2 must be enabled, and exploitation requires knowledge of internal resource identifiers.


19) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-14209)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive user information.

The vulnerability exists due to a missing authorization check in the BruteForceUsersResource component of the admin UI extension when handling requests to the brute-force-user endpoint. A remote user can request a target user\'s profile through the brute-force-user endpoint to disclose sensitive user information.

Fine-Grained Admin Permissions v2 must be enabled, and exploitation requires knowledge of the target user\'s ID.


Remediation

Install update from vendor's website.

References