Skip to main content

Red Hat CVE-2026-4636

| EUVD-2026-18213 HIGH
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CWE-551)
2026-04-02 redhat GHSA-f2hx-5fx3-hmcv
Information Disclosure Red Hat
8.1
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Re-analysis Queued
Apr 16, 2026 - 20:52 vuln.today
cvss_changed
Patch released
Apr 04, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 13:15 euvd
EUVD-2026-18213
Analysis Generated
Apr 02, 2026 - 13:15 vuln.today
CVE Published
Apr 02, 2026 - 12:45 nvd
HIGH 8.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 53 maven packages depend on org.keycloak:keycloak-services (25 direct, 28 indirect)

Ecosystem-wide dependent count for version 26.5.7.

DescriptionNVD

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

AnalysisAI

Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gain unauthorized access to victim-owned resources. The vulnerability (confirmed actively exploited - CISA KEV) enables attackers to inject arbitrary resource identifiers during policy creation, obtaining Requesting Party Tokens for resources they do not own. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Disable UMA_PROTECTION role assignments or restrict uma_protection role to trusted administrators only; audit Keycloak audit logs for suspicious policy creation activity and unusual token requests. Within 7 days: Implement network segmentation to limit Keycloak access to internal networks only; escalate to Red Hat support for security advisory updates and patched version timelines. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

More from same product – last 7 days

CVE-2026-9277 HIGH
8.1 May 22

Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
CVE-2026-9256 HIGH
8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

Share

CVE-2026-4636 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy