KEYCLOAK-SERVICES · CVE-2026-107123 · Runtime
NO FIX YET
Keycloak's SAML XML parser spends excessive CPU time on overly long dateTime or duration values in crafted requests. An unauthenticated remote attacker can send such SAML requests to drive CPU use up and deny service to all users.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak servers (upstream keycloak-services and Red Hat build of Keycloak, rhbk/keycloak-rhel9, as mapped by Red Hat) that accept SAML requests from the network. The attacker needs no login. Versions are not yet published, so treat any self-hosted Keycloak with reachable SAML endpoints as possibly exposed until ranges are stated. Deployments that do not expose SAML endpoints are less likely to be reachable, but the vendor does not confirm this.
Not affected if managed-hosting, saml-disabled
Who cares identity, keycloak, saml, self-hosted
Unknown from the sources.
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.