Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen

Summary

Product

Vulnerabilities 1

• Medium 4.3
  CVE-2026-3190

  Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

  A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server client, even without …

  Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.11 org.keycloak:keycloak-services Wolfi Maven
  Mar 26, 2026

Revision history

1. 2026-04-06 #4

   Neue Updates von Red Hat aufgenommen

2. 2026-03-26 #3

   Referenz(en) aufgenommen: EUVD-2026-16309

3. 2026-03-18 #2

   Neue Updates aufgenommen

4. 2026-02-24 #1

   Initiale Fassung

References

• Red Hat Bugtracker vom 2026-02-24
  https://bugzilla.redhat.com/show_bug.cgi?id=2442572
• Red Hat Customer Portal vom 2026-02-24
  https://access.redhat.com/security/cve/CVE-2026-3190
• Keycloak 26.5.6 release notes vom 2026-03-19
  https://www.keycloak.org/2026/03/keycloak-2656-released
• Red Hat Security Advisory RHSA-2026:6477 vom 2026-04-02
  https://access.redhat.com/errata/RHSA-2026:6477
• Red Hat Security Advisory RHSA-2026:6478 vom 2026-04-02
  https://access.redhat.com/errata/RHSA-2026:6478