CVE-2026-2092

Katalog CVE

CVSS 7.7 · High EPSS 0,36%

Kerentanan Improper Validation of Specified Type of Input pada redhat build of keycloak. Skor CVSS 3.1 7.7 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.7 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1287: Improper Validation of Specified Type of Input

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:3925 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3926 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3947 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3948 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-2092 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2437296 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json advisory vendor
• https://access.redhat.com/errata/RHSA-2026:76128
• https://access.redhat.com/errata/RHSA-2026:76129
• https://access.redhat.com/errata/RHSA-2026:76130
• https://access.redhat.com/errata/RHSA-2026:76132
• https://access.redhat.com/errata/RHSA-2026:76134