Vulnerability-Lookup

RHSA-2026:96039

Vulnerability from csaf_redhat - Published: 2026-11-07 14:49 - Updated: 2026-11-07 21:37

Summary

Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Images Security Update

Severity

Important

Notes

Topic: New images are available for Red Hat build of Keycloak 26.6.9 and Red Hat build of Keycloak 26.6.9 Operator, running on OpenShift Container Platform

Details: Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat build of Keycloak for OpenShift image provides an authentication server that you can use to log in centrally, log out, and register. You can also manage user accounts for web applications, mobile applications, and RESTful web services. Red Hat build of Keycloak Operator for OpenShift simplifies deployment and management of Keycloak 26.6.9 clusters. This erratum releases new images for Red Hat build of Keycloak 26.6.9 for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments, aligning with the standalone product release. Security fixes: * SAML redirect binding signature bypass via percent-encoded parameter names (CVE-2026-117691)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-117691

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

9.1 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-347 - Improper Verification of Cryptographic Signature

Affected products

Fixed 9 products

Product	Version	Remediation
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

7 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:96039	self
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-117691	self
https://bugzilla.redhat.com/show_bug.cgi?id=2561977	external
https://www.cve.org/CVERecord?id=CVE-2026-117691	external
https://nvd.nist.gov/vuln/detail/CVE-2026-117691	external

Acknowledgments

Think-it GmbH Mayssen Aidoudi

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "New images are available for Red Hat build of Keycloak 26.6.9 and\nRed Hat build of Keycloak 26.6.9 Operator, running on OpenShift\nContainer Platform",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat build of Keycloak is an integrated sign-on solution,\navailable as a Red Hat JBoss Middleware for OpenShift containerized\nimage. The Red Hat build of Keycloak for OpenShift image provides\nan authentication server that you can use to log in centrally, log\nout, and register. You can also manage user accounts for web\napplications, mobile applications, and RESTful web services.\n\nRed Hat build of Keycloak Operator for OpenShift simplifies\ndeployment and management of Keycloak 26.6.9 clusters.\n\nThis erratum releases new images for Red Hat build of Keycloak\n26.6.9 for use within the OpenShift Container Platform cloud\ncomputing Platform-as-a-Service (PaaS) for on-premise or private\ncloud deployments, aligning with the standalone product release.\n\nSecurity fixes:\n* SAML redirect binding signature bypass via percent-encoded parameter names (CVE-2026-117691)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:96039",
        "url": "https://access.redhat.com/errata/RHSA-2026:96039"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96039.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Keycloak 26.6.9 Images Security Update",
    "tracking": {
      "current_release_date": "2026-11-07T21:37:46+00:00",
      "generator": {
        "date": "2026-11-07T21:37:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:96039",
      "initial_release_date": "2026-11-07T14:49:00+00:00",
      "revision_history": [
        {
          "date": "2026-11-07T14:49:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-07T14:49:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T21:37:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Keycloak 26.6",
                "product": {
                  "name": "Red Hat build of Keycloak 26.6",
                  "product_id": "9Base-RHBK-26.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:build_keycloak:26.6::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Keycloak"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
                  "product_id": "rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-25"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14?arch=s390x\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-26"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-25"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
                "product": {
                  "name": "rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
                  "product_id": "rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle\u0026tag=26.6.9-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc?arch=amd64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-26"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64",
                  "product_id": "rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-25"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a?arch=arm64\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-26"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9\u0026tag=26.6-25"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
                "product": {
                  "name": "rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
                  "product_id": "rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator\u0026tag=26.6-26"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64 as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64"
        },
        "product_reference": "rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64 as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64 as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64 as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64 as a component of Red Hat build of Keycloak 26.6",
          "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64"
        },
        "product_reference": "rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64",
        "relates_to_product_reference": "9Base-RHBK-26.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Mayssen Aidoudi"
          ],
          "organization": "Think-it GmbH"
        }
      ],
      "cve": "CVE-2026-117691",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-10-26T20:13:03+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2561977"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that it allows for full account takeover of federated users. Successful exploitation allows an attacker to log in as any user and access their roles and data without authorization. The vulnerability\u0027s root cause is an inconsistent parsing of percent-encoded query parameters between the signature verification and message processing logic in the SAML redirect binding.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
          "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-117691"
        },
        {
          "category": "external",
          "summary": "RHBZ#2561977",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561977"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-117691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-117691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-117691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117691"
        }
      ],
      "release_date": "2026-11-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-07T14:49:00+00:00",
          "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.",
          "product_ids": [
            "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:96039"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to align query parameter parsing between signature verification and request processing in Keycloak\u0027s SAML HTTP-Redirect binding so percent-encoded parameter names cannot evade signature checks: upgrade to the fixed Rhbk/Keycloak Rhel/Keycloak Services builds, which eliminates the parsing discrepancy between raw query parameter signature verification and decoded parameter processing in the SAML redirect binding, closing crafted HTTP GET request containing a percent-encoded unsigned SAML parameter placed before a legitimately signed parameter. Until patched, this is a concern on Keycloak instances configured to use SAML HTTP-Redirect binding for federated identity, so Audit and restrict account registration on external Identity Providers to prevent attackers from capturing legitimately signed redirect-binding messages. These controls limit blast radius and contain exploitation, but they do not fix the underlying SAML parameter parsing discrepancy signature bypass \u2014 apply the upstream patch to fully remediate.",
          "product_ids": [
            "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:6d43917ace52331b28623246d61a202de7fd49bbc462578b7676ce0c90eeaead_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:003b5b770b54ee6139a598a1dfb249d7971bc863f3b926c01a7aedea59be5cbc_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:1be1c23fb1385c9e01ffe3b27afa9a30ad0da3b7c016623529b529ec8f548f1a_arm64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:923b40198c0d38a481a76ebaf3a28b262599d12382e6d666803df37bceb3cf14_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:b5a575021f691de0533a43da73ec72908c6521da7326ea922977491ab281565b_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:04b0afc934adba6f0fc62d371927f9b405555b764379a12ae2d1aee3e899fe15_s390x",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:088100d6690db46248966ca581ce645a28bce379505ccf414ae309240221bb21_ppc64le",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:0de6b0a3bfe5135725e33bb1da8fd22c1fc94e754814d6c3ddef92105a094116_amd64",
            "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:cadcb5911714c8ffcd851c0035f04aa399d3677579bcad825b6b296fefe0b288_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names"
    }
  ]
}

CVE-2026-117691 (GCVE-0-2026-117691)

Vulnerability from cvelistv5 – Published: 2026-11-05 13:27 – Updated: 2026-11-07 15:39

Title

Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

Summary

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 16:28 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1131 records in the last 180 days details

References

4 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:96039	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:96040	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-117691	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2561977	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6.9-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-25 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-26 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.9	cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Date Public

2026-11-05 00:00

Credits

Red Hat would like to thank Mayssen Aidoudi (Think-it GmbH) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-117691",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T16:28:53.520705Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T16:29:19.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.9-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-25",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-26",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.6.9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Mayssen Aidoudi (Think-it GmbH) for reporting this issue."
        }
      ],
      "datePublic": "2026-11-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T15:39:27.366Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:96039",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:96039"
        },
        {
          "name": "RHSA-2026:96040",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:96040"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-117691"
        },
        {
          "name": "RHBZ#2561977",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561977"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-26T20:13:03.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-11-05T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to align query parameter parsing between signature verification and request processing in Keycloak\u0027s SAML HTTP-Redirect binding so percent-encoded parameter names cannot evade signature checks: upgrade to the fixed Rhbk/Keycloak Rhel/Keycloak Services builds, which eliminates the parsing discrepancy between raw query parameter signature verification and decoded parameter processing in the SAML redirect binding, closing crafted HTTP GET request containing a percent-encoded unsigned SAML parameter placed before a legitimately signed parameter. Until patched, this is a concern on Keycloak instances configured to use SAML HTTP-Redirect binding for federated identity, so Audit and restrict account registration on external Identity Providers to prevent attackers from capturing legitimately signed redirect-binding messages. These controls limit blast radius and contain exploitation, but they do not fix the underlying SAML parameter parsing discrepancy signature bypass \u2014 apply the upstream patch to fully remediate."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-117691",
    "datePublished": "2026-11-05T13:27:23.748Z",
    "dateReserved": "2026-10-27T13:49:55.445Z",
    "dateUpdated": "2026-11-07T15:39:27.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted