CVE-2026-2092
Redhat Build Of Keycloak 26.2 – 26.2.14
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-2092 is a high-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2092 is a vulnerability in Keycloak's Security Assertion Markup Language (SAML) broker endpoint, which fails to properly validate encrypted assertions when the overall SAML response is not signed. Published on 2026-03-18, this flaw carries a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L) and is classified under CWE-1287. It affects Keycloak deployments relying on SAML identity brokering for authentication.
An attacker with low privileges (PR:L) who possesses a valid signed SAML assertion can exploit this by crafting a malicious SAML response that injects an encrypted assertion for an arbitrary principal. Exploitation requires network access and high attack complexity but no user interaction. Successful attacks enable unauthorized access by impersonating other users and potential information disclosure.
Red Hat has addressed this vulnerability in multiple security advisories, including RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, and RHSA-2026:3948, with additional details available at https://access.redhat.com/security/cve/CVE-2026-2092. Security practitioners should apply these updates to mitigate the issue in affected Keycloak instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12688
Vulnerability Data
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by…
more
crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly requires validation of information inputs, which structurally prevents type-validation failures from being introduced or exploitable.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input type validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-validation flaws but does not prevent them during development.
Secure development lifecycle mandates input validation and type checking to prevent improper type handling.
Application security requirements explicitly include validation of input data types and formats.
Secure architecture principles promote defensive input handling and type enforcement at system boundaries.
Secure coding standards directly require proper type validation of all external inputs.