NCSC-2026-0326

Vulnerability from csaf_ncscnl - Published: 2026-08-25 13:39 - Updated: 2026-08-25 13:39
Summary
Kwetsbaarheden verholpen in Keycloak
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.
Interpretaties: De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen. In Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server's Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.
Oplossingen: Red Hat heeft updates uitgebracht om deze kwetsbaarheden in Keycloak te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-341: Predictable from Observable State
CWE-502: Deserialization of Untrusted Data
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-863: Incorrect Authorization
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-14613

A Moderate severity vulnerability in Keycloak's admin interface with FGAP v2 enabled allows certain administrators to view metadata of hidden groups due to missing permission checks on role-to-group mappings in the RoleContainerResource component.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-15571

A critical vulnerability in Keycloak's legacy client-initiated account-linking endpoint allows attackers to predict security hashes and forge linking URLs, enabling unauthorized account linking and full account takeover.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-341 - Predictable from Observable State
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-15945

A vulnerability in Keycloak's administrative API group search under FGAP v2 allows delegated administrators to bypass access controls and view unauthorized parent group details by exploiting improper filtering during hierarchical group searches.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-639 - Authorization Bypass Through User-Controlled Key
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-17048

A vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access client secrets due to improper boundary enforcement during secret rotation.

5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-18963

A critical vulnerability in Keycloak versions before 26.7.2, 26.6.6, and 26.4.15 allows unauthenticated attackers to bypass email verification in the reset-credentials flow, enabling full account takeover via improper state validation.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-45292

OpenTelemetry Java versions prior to 1.62.0 contained a vulnerability in baggage propagation that allowed unbounded memory and CPU consumption via oversized baggage headers, potentially impacting downstream services, fixed by enforcing W3C size limits in 1.62.0.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-59888

Jackson-databind versions 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 had vulnerabilities allowing bypass of @JsonIgnore and @JsonIgnoreProperties on Java Records with PropertyNamingStrategy, fixed in versions 2.18.8, 2.21.4, 3.1.4, and 2.18.9.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
CVE-2026-59889

Multiple vulnerabilities in Jackson components, including jackson-databind versions 2.18.0 to 2.18.9 and others, allow bypass of @JsonView and @JsonIgnoreProperties restrictions, enabling unauthorized JSON property writes and privilege escalation.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-863 - Incorrect Authorization
Affected products
Product Identifier Version Remediation
vers:unknown/*
Keycloak / keycloak
 vers:unknown/*
vers:unknown/*
Red Hat / Build of Keycloak
 vers:unknown/*
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Red Hat heeft meerdere kwetsbaarheden verholpen in Keycloak.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met CVE-2026-18963 kan een ongeauthenticeerde externe aanvaller in staat stellen om elke gebruikersaccount over te nemen door een wachtwoordreset af te dwingen. Door deze kwetsbaarheid valt het e-mailverificatieproces bij wachtwoordreset te omzeilen en wachtwoorden van gebruikers te wijzigen.\n\nIn Keycloak zijn daarnaast kwetsbaarheden aanwezig in de Fine-Grained Admin Permissions (FGAP) v2, waardoor bepaalde beheerders met beperkte permissies metadata van verborgen groepen kunnen inzien en details van ongeautoriseerde oudergroepen kunnen blootstellen. Verder kunnen geauthenticeerde aanvallers via een legacy client-initiated account-linking endpoint CSRF-bescherming omzeilen en accounts overnemen. Ook kunnen gedelegeerde beheerders met alleen leesrechten client secrets uitlezen door een fout in de secret rotation. Voor OpenTelemetry Java was er een kwetsbaarheid waarbij het ontbreken van limieten op baggage headers leidde tot onbegrensd geheugen- en CPU-gebruik, wat Denial-of-Service kan veroorzaken. Bij Jackson-libraries is een bypass van de @JsonIgnore annotatie in Java Records vastgesteld, waardoor ongewenste toewijzing aan constructorparameters mogelijk is. Ook zijn er bypasses van @JsonIgnoreProperties, ontbrekende view guards op @JsonUnwrapped en ongeautoriseerde schrijfacties op velden met @JsonView. Oracle Database Server\u0027s Fleet Patching and Provisioning component is eveneens getroffen door een kwetsbaarheid die ongeautoriseerde data toegang of Denial-of-Service kan veroorzaken.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Red Hat heeft updates uitgebracht om deze kwetsbaarheden in Keycloak te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Predictable from Observable State",
        "title": "CWE-341"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Authorization Bypass Through User-Controlled Key",
        "title": "CWE-639"
      },
      {
        "category": "general",
        "text": "Weak Password Recovery Mechanism for Forgotten Password",
        "title": "CWE-640"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
        "title": "CWE-915"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56519"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56520"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56523"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://access.redhat.com/errata/RHSA-2026:56524"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.keycloak.org/2026/08/keycloak-2672-released"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Keycloak",
    "tracking": {
      "current_release_date": "2026-08-25T13:39:25.285061Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0326",
      "initial_release_date": "2026-08-25T13:39:25.285061Z",
      "revision_history": [
        {
          "date": "2026-08-25T13:39:25.285061Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "keycloak"
          }
        ],
        "category": "vendor",
        "name": "Keycloak"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Build of Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14613",
      "notes": [
        {
          "category": "description",
          "text": "A Moderate severity vulnerability in Keycloak\u0027s admin interface with FGAP v2 enabled allows certain administrators to view metadata of hidden groups due to missing permission checks on role-to-group mappings in the RoleContainerResource component.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-14613 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14613.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-14613"
    },
    {
      "cve": "CVE-2026-15571",
      "cwe": {
        "id": "CWE-341",
        "name": "Predictable from Observable State"
      },
      "notes": [
        {
          "category": "other",
          "text": "Predictable from Observable State",
          "title": "CWE-341"
        },
        {
          "category": "description",
          "text": "A critical vulnerability in Keycloak\u0027s legacy client-initiated account-linking endpoint allows attackers to predict security hashes and forge linking URLs, enabling unauthorized account linking and full account takeover.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15571 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15571.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15571"
    },
    {
      "cve": "CVE-2026-15945",
      "cwe": {
        "id": "CWE-639",
        "name": "Authorization Bypass Through User-Controlled Key"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authorization Bypass Through User-Controlled Key",
          "title": "CWE-639"
        },
        {
          "category": "description",
          "text": "A vulnerability in Keycloak\u0027s administrative API group search under FGAP v2 allows delegated administrators to bypass access controls and view unauthorized parent group details by exploiting improper filtering during hierarchical group searches.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-15945 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15945.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-15945"
    },
    {
      "cve": "CVE-2026-17048",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in the Keycloak Admin REST API allows delegated administrators with view-only permissions to access client secrets due to improper boundary enforcement during secret rotation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-17048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17048.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-17048"
    },
    {
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "notes": [
        {
          "category": "other",
          "text": "Weak Password Recovery Mechanism for Forgotten Password",
          "title": "CWE-640"
        },
        {
          "category": "description",
          "text": "A critical vulnerability in Keycloak versions before 26.7.2, 26.6.6, and 26.4.15 allows unauthenticated attackers to bypass email verification in the reset-credentials flow, enabling full account takeover via improper state validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-18963 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18963.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-18963"
    },
    {
      "cve": "CVE-2026-45292",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "OpenTelemetry Java versions prior to 1.62.0 contained a vulnerability in baggage propagation that allowed unbounded memory and CPU consumption via oversized baggage headers, potentially impacting downstream services, fixed by enforcing W3C size limits in 1.62.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-45292 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45292.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-45292"
    },
    {
      "cve": "CVE-2026-59888",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
          "title": "CWE-915"
        },
        {
          "category": "description",
          "text": "Jackson-databind versions 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 had vulnerabilities allowing bypass of @JsonIgnore and @JsonIgnoreProperties on Java Records with PropertyNamingStrategy, fixed in versions 2.18.8, 2.21.4, 3.1.4, and 2.18.9.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59888 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59888.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59888"
    },
    {
      "cve": "CVE-2026-59889",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in Jackson components, including jackson-databind versions 2.18.0 to 2.18.9 and others, allow bypass of @JsonView and @JsonIgnoreProperties restrictions, enabling unauthorized JSON property writes and privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-59889 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59889.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-59889"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.