Read the docs
TI-2026-07985 Aliases CVE-2026-9088GHSA-6g26-7cx5-mrrg

Keycloak: keycloak: information disclosure due to user profile permission bypass

Priority LOW 14CWE-1220Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 26.7.0Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 26.4—26.4.13-1Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-19Patch availableCNA
Red HatRed Hat build of Keycloak 26.4—26.4-19Patch availableCNA
Red HatRed Hat build of Keycloak 26.4.13——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6—26.6.3-3Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-6Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-6Patch availableCNA
Red HatRed Hat build of Keycloak 26.6.3——Not affectedCNA
—org.keycloak:keycloak-services (Maven)before 26.7.026.7.0Patch availableGHSA-6g26-7cx5-mrrg
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.13-1 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-19 Patch available CNA
  • Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-19 Patch available CNA
  • Red Hat build of Keycloak 26.4.13 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6.3-3 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-6 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-6 Patch available CNA
  • Red Hat build of Keycloak 26.6.3 VendorRed Hat Affected — Fixed in — Not affected CNA
  • org.keycloak:keycloak-services (Maven) Vendor— Affected before 26.7.0 Fixed in 26.7.0 Patch available GHSA-6g26-7cx5-mrrg

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:26.4::el926.4—Red Hat
cpe:/a:redhat:build_keycloak:26.6::el926.6—Red Hat
  • cpe:/a:redhat:build_keycloak:26.4::el9 Versions 26.4 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.6::el9 Versions 26.6 — ·Red Hat

Remediation

  • Fix · GHSA-6g26-7cx5-mrrg org.keycloak:keycloak-services (Maven) Fixed in 26.7.0 Advisory →

Red Hat 4 advisories

  • RHSA-2026:30050 Released 2026-06-25 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.13 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:30049 Released 2026-06-25 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.13 Security Update
    • Red Hat build of Keycloak 26.4.13
  • RHSA-2026:25098 Released 2026-06-10 · Red Hat rating Moderate
    Red Hat build of Keycloak 26.6.3 Update
    • Red Hat build of Keycloak 26.6.3
Show 1 more Red Hat advisories
  • RHSA-2026:25097 Released 2026-06-10 · Red Hat rating Moderate
    Red Hat build of Keycloak 26.6.3 Images Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of Keycloak 26.4Fixed RHSA-2026:30050
Red Hat build of Keycloak 26.4.13Fixed RHSA-2026:30049
Red Hat build of Keycloak 26.6Fixed RHSA-2026:25097
Red Hat build of Keycloak 26.6.3Fixed RHSA-2026:25098

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9088
  2. 2026-10-03 Alias added: GHSA-6g26-7cx5-mrrg

References

Advisory 5

Other 6

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7412 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences