Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen

Summary

Product

Vulnerabilities 1

• Low 2.7
  CVE-2026-3911

  Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

  A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured…

  Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.11 keycloak-26.5-iamguarded-compat Wolfi Maven
  Mar 11, 2026

Revision history

1. 2026-04-06 #3

   Neue Updates von Red Hat aufgenommen

2. 2026-03-18 #2

   Neue Updates aufgenommen

3. 2026-03-10 #1

   Initiale Fassung

References

• Red Hat Bugtracker vom 2026-03-10
  https://bugzilla.redhat.com/show_bug.cgi?id=2446392
• RedHat Customer Portal vom 2026-03-10
  https://access.redhat.com/security/cve/cve-2026-3911
• NIST Vulnerability Database vom 2026-03-10
  https://nvd.nist.gov/vuln/detail/CVE-2026-3911
• Keycloak 26.5.6 release notes vom 2026-03-19
  https://www.keycloak.org/2026/03/keycloak-2656-released
• Red Hat Security Advisory RHSA-2026:6477 vom 2026-04-02
  https://access.redhat.com/errata/RHSA-2026:6477
• Red Hat Security Advisory RHSA-2026:6478 vom 2026-04-02
  https://access.redhat.com/errata/RHSA-2026:6478