Live › vulnerability › CVE-2026-9800
Keycloak Policy Enforcer compares request URIs incorrectly, so any logged-in user can include the configured access-denied page path in a request and skip role, scope and UMA permission checks. An attacker who already has a valid account can reach protected resources they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC, 0h before NVD. All times on this page are UTC.
Applications that use Keycloak Policy Enforcer to protect resources with role, scope or UMA policies are exposed, and any user with a valid login can exploit it. The sources do not say which deployment setups are affected beyond the configured access-denied page path. Teams that do not use Policy Enforcer, or only use Keycloak for login without these policies, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | 26.6.4 |
| org.keycloak:keycloak-policy-enforcer | maven | < 26.0.10 | 26.0.10 |
| redhat build of keycloak | vendor | >= 26.4, < 26.4.13 | 26.4.13 |
| redhat build of keycloak | vendor | >= 26.6, <= 26.6.4 | – |
org.keycloak:keycloak-services and org.keycloak:keycloak-policy-enforcer and compare against the fixed versions below.keycloak-services: upgrade to 26.6.4 or laterkeycloak-policy-enforcer: upgrade to 26.0.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-9800")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.