CVE-2026-3190
Fixed upstream EPSS <1%CVSS 4.3
A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without the `uma_protection` role, to enumerate all permission tickets in the system. This vulnerability partial leads to information disclosure.
Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.11
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-model-jpa | 26.5.6 |
| Maven | org.keycloak:keycloak-server-spi-private | 26.5.6 |
| Maven | org.keycloak:keycloak-services | 26.5.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.3-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |