Skip to content
Fencer Intel
high 8.1

CVE-2026-9800 json

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

published 4mo ago modified 13d ago also BIT-keycloak-2026-9800 , EUVD-2026-39471 , GHSA-f5p5-6xmx-p252

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

Patch / fix

  • maven org.keycloak:keycloak-services 26.6.4
  • maven org.keycloak:keycloak-policy-enforcer 26.0.10
  • bitnami keycloak 26.4.13, 26.7.0
  • Red Hat Red Hat build of Keycloak 26.4 26.4-19, 26.4-22, 26.4.13-1, 26.4.14-1
  • Red Hat Red Hat build of Keycloak 26.6 26.6-8, 26.6.4-2
  • Red Hat Red Hat build of Quarkus 3.27.4.SP2 26.0.10.redhat-00001
  • Red Hat Red Hat build of Quarkus 3.33.2.SP2 26.0.10.redhat-00001

Is CVE-2026-9800 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-9800 updated cvss 8.1

keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison

  • Red Hat build of Quarkus keycloak-policy-enforcer Red Hat Single Sign-On 7 servlet-policy-enforcer
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-19, rhbk/keycloak-rhel9 26.4-22, rhbk/keycloak-rhel9-operator 26.4-19, rhbk/keycloak-rhel9-operator 26.4-22, rhbk/keycloak-operator-bundle 26.4.13-1, rhbk/keycloak-operator-bundle 26.4.14-1
    fixed: vendor fix RHSA-2026:50847
  • Red Hat build of Keycloak 26.4.13
    fixed: vendor fix RHSA-2026:30049
  • Red Hat build of Keycloak 26.4.14
    fixed: vendor fix RHSA-2026:50846
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-8, rhbk/keycloak-rhel9-operator 26.6-8, rhbk/keycloak-operator-bundle 26.6.4-2
    fixed: vendor fix RHSA-2026:30084
  • Red Hat build of Keycloak 26.6.4
    fixed: vendor fix RHSA-2026:30083
  • Red Hat build of Quarkus 3.27.4.SP2 keycloak-policy-enforcer 26.0.10.redhat-00001
    fixed: vendor fix RHSA-2026:36002
  • Red Hat build of Quarkus 3.33.2.SP2 keycloak-policy-enforcer 26.0.10.redhat-00001
    fixed: vendor fix RHSA-2026:36013
show 2 more
  • Red Hat build of Quarkus 3.27.4.SP2 jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.2.SP2 jna 5.8.0, bson 5.6.4, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1018 more
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform Expansion Pack keycloak-policy-enforcer
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.keycloak:keycloak-services
<26.6.4
26.6.4
maven org.keycloak:keycloak-policy-enforcer
<26.0.10
26.0.10
bitnami keycloak
>=26.4.0, <26.4.13
>=26.6.0, <26.7.0
26.4.13
26.7.0

Affected products

  • Red Hat Red Hat build of Keycloak 26.4
  • Red Hat Red Hat build of Keycloak 26.4.13
  • Red Hat Red Hat build of Keycloak 26.4.14
  • Red Hat Red Hat build of Keycloak 26.6
  • Red Hat Red Hat build of Keycloak 26.6.4
  • Red Hat Red Hat build of Quarkus 3.27.4.SP2
  • Red Hat Red Hat build of Quarkus 3.33.2.SP2
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-1025 Comparison Using Wrong Factors

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.