KEYCLOAK · CVE-2026-107602 · Infrastructure
FIX → 26.8.2 · 26.6.8 · 26.4.17 ✓ verified
Keycloak's SAML 1.1 KeyInfo parser loops forever on a legal ds:KeyName element. Keycloak's issue calls it unauthenticated CPU and worker-pool exhaustion that needs a restart. Fixed in 26.8.2.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Keycloak as their identity and access management service and accept SAML 1.1 requests from the internet are exposed, since the flaw is reached before any login. Deployments that do not expose SAML endpoints, or that sit behind access controls that block them, are less exposed. The sources do not give the affected version range.
Not affected if behind-network-filter, saml-disabled
Who cares identity, keycloak, saml, self-hosted
Upgrade to 26.8.2 · 26.6.8 · 26.4.17
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
26.8.2 (released 2026-11-05)26.6.8 and 26.4.17 backports; check those release pages before relying on them