CVE-2026-7307

⚠️ high

Summary

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

CVSS Score

7.5

High

EPSS Score

0.7

Exploit Probability

Published Date

2026-05-19

First Seen: 2026-05-20

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.9% of all 333,415 vulnerabilities in our database.

#103,718

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 19, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Red Hat would like to thank Anchels for reporting this issue.

SSVC data provided by CISA

Last Modified 2026-06-30

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-1286

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
redhat	build_of_keycloak	Affected	> 26.4 < 26.4.12

🔗 References 7

https://access.redhat.com/errata/RHSA-2026:19594

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19595

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19596

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:19597

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-7307

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2476526

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/...

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-12388	🔶 medium	6.5	0.2	A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user informati...	2026-06-30
CVE-2026-14209	🔶 medium	4.3	0.2	A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass secur...	2026-06-30
CVE-2026-4629	🔶 medium	6.5	0.2	A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability b...	2026-06-30
CVE-2026-9083	🔶 medium	4.9	0.5	A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submi...	2026-06-25
CVE-2026-9086	⚠️ high	7.3	0.4	A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` ...	2026-06-25
CVE-2026-9099	⚠️ high	7.7	0.3	A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin RE...	2026-06-25

These CVEs affect the same products