Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

高 7.7CVE-2026-2092 · BIT-keycloak-2026-2092 · GHSA-794g-x443-36f7 · 18/03/2026 公開 · 06/10/2026 更新

要点

CVE-2026-2092 は org.keycloak:keycloak-services, build of keycloak (redhat) に影響する深刻度「高」 (CVSS 7.7) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 31.4% より高い）。
対処：26.5.5, 26.2.14, 26.4.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.keycloak:keycloak-services Maven	`≥ 26.3.0, ≤ 26.4.7≥ 26.5.0, < 26.5.5≤ 26.2.5`	`26.5.5`
build of keycloak redhat	`≥ 26.2, < 26.2.14≥ 26.4, < 26.4.10`	`26.2.1426.4.10`

概要

Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

NVD の説明

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.