CVE-2026-2092

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Mar 18, 2026
Source updated: Oct 6, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2.14-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-16	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-16	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2.14

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2.14
Platforms: Unknown
Default status: unaffected
Package: rhbk/keycloak-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.4

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.4
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.4 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.4.10-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.4

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.4
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.4 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.4-12	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.4

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.4
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.4 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.4-12	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.4.10

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.4.10
Platforms: Unknown
Default status: unaffected
Package: rhbk/keycloak-rhel9
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7.6.13

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6.13
Platforms: Unknown
Default status: unaffected
Package: keycloak-services
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7.6 for RHEL 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 7
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el7sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 8

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 8
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el8sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 9

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 9
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.20-1.redhat_00001.1.el9sso	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rh-sso-7/sso76-openshift-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.6-85	`unaffected`	rpm	*	Unavailable	None listed