CVE-2026-2092
Fixed in a distro release EPSS <1%CVSS 7.7
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
Products: Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.14, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.10, Red Hat Single Sign-On 7.6.13, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.3-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4 | 26.4.7-r10 |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4-iamguarded-compat | 26.4.7-r10 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4 | 26.4.7-r16 |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | 26.4.7-r16 |
| Chainguard | request-9047-keycloak-fips-26.4 | 26.4.7-r19 |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | 26.4.7-r19 |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.20-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.20-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak | 0:18.0.20-1.redhat_00001.1.el9sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.20-1.redhat_00001.1.el7sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.20-1.redhat_00001.1.el8sso |
| Red Hat red hat single sign on 7.6 | rh-sso7-keycloak-server | 0:18.0.20-1.redhat_00001.1.el9sso |
| Wolfi | keycloak-26.4 | 26.4.7-r10 |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-iamguarded-compat | 26.4.7-r10 |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |