CyberSecBulletin
CVE-2026-2092NVD status: Modified

Red Hat build of Keycloak 26.2: Improper Validation of Specified Type of Input

Published Updated By the CyberSecBulletin desk

CVE-2026-2092 is a high-severity improper validation of specified type of input vulnerability in Red Hat build of Keycloak 26.2 from Red Hat, with a CVSS 3.1 base score of 7.7 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. There is no confirmed exploitation so far. EPSS estimates a 0.41% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Build Of Keycloak to 26.2.14 or 26.4.10, whichever matches your release line, or a later version.
  2. Read the advisory on access.redhat.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Red HatRed Hat build of Keycloak 26.2Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.2.14Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.4Not specified in the recordNot stated
Red HatRed Hat build of Keycloak 26.4.10Not specified in the recordNot stated
Red HatRed Hat Single Sign-On 7.6.13Not specified in the recordNot stated
Red HatRed Hat Single Sign-On 7.6 for RHEL 7Not specified in the recordNot stated
Red HatRed Hat Single Sign-On 7.6 for RHEL 8Not specified in the recordNot stated
Red HatRed Hat Single Sign-On 7.6 for RHEL 9Not specified in the recordNot stated
Red HatRHEL-8 based Middleware ContainersNot specified in the recordNot stated
Red HatBuild Of Keycloak26.2 up to, but not including, 26.2.14; 26.4 up to, but not including, 26.4.1026.2.14, 26.4.10

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
LowLimited modification of data is possible.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L. Scored by CNA (redhat.com).

Scoring systemScoreSeverityScored by
CVSS 3.17.7HighCNA (redhat.com)
CVSS 3.17.7HighCNA

Official description

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

More Improper Validation of Specified Type of Input vulnerabilities (CWE-1287)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Red Hat build of Keycloak 26.2

All Red Hat build of Keycloak 26.2 vulnerabilities

Recent Improper Validation of Specified Type of Input vulnerabilities

Spotted an error? Tell us.