CVE-2026-7307
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-05-19 12:16:19.423000
Last modified
2026-10-26 13:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-7307",
"sourceIdentifier": "[email protected]",
"published": "2026-05-19T12:16:19.423",
"lastModified": "2026-10-26T13:10:00.140",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en Keycloak. Un atacante remoto no autenticado puede enviar una entrada XML especialmente diseñada al endpoint de Security Assertion Markup Language (SAML). Esta entrada maliciosa puede causar un alto uso de CPU y agotamiento de hilos de trabajo, lo que lleva a una denegación de servicio (DoS) donde el servidor deja de estar disponible."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/keycloak/keycloak",
"packageName": "keycloak",
"versions": [
{
"version": "0",
"lessThan": "26.2.16",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "26.4.12",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "26.6.2",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2.16-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-21",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-21",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2.16",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4.12-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-17",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-17",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4.12",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6.13",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
],
"versions": [
{
"version": "0:18.0.20-1.redhat_00001.1.el7sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
],
"versions": [
{
"version": "0:18.0.20-1.redhat_00001.1.el8sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7.6 for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-sso7-keycloak",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
],
"versions": [
{
"version": "0:18.0.20-1.redhat_00001.1.el9sso",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "RHEL-8 based Middleware Containers",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rh-sso-7/sso76-openshift-rhel8",
"cpes": [
"cpe:/a:redhat:rhosemc:1.0::el8"
],
"versions": [
{
"version": "7.6-85",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2.16-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-21",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-21",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2.16",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4.12-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-17",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-17",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4.12",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-19T12:49:06.304635Z",
"id": "CVE-2026-7307",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1286"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1286"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
"versionStartIncluding": "26.4",
"versionEndExcluding": "26.4.12",
"matchCriteriaId": "E71FD53F-2C05-4B84-9BEE-BB287017B322"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:19594",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19595",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19596",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19597",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:76128",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:76129",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:76130",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:76132",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:76134",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-7307",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476526",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19594",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19595",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19596",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19597",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-7307",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476526",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}