Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-9794 is a medium-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Gather Victim Host Information (T1592); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-11 (Error Handling) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32709
Vulnerability Data
A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct…
more
faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-209 error-based info disclosure on public SAML endpoint directly enables gathering of client/protocol configuration details (T1592.002).
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires error messages to avoid revealing exploitable details such as protocol type distinctions via distinct faultstrings, eliminating the CWE-209 root cause on the SAML ECP endpoint.
Boundary protection can restrict or filter unauthenticated SOAP traffic to the SAML ECP endpoint, reducing the attack surface for crafted client-ID probes that elicit information disclosure.
System monitoring can detect anomalous unauthenticated request patterns to the SAML ECP endpoint that attempt to enumerate protocol types through response differences.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid exposing sensitive data in errors.
Security testing can detect error messages that leak sensitive information.
Logging policy can require suppression of sensitive data in error messages.
Secure SDLC mandates error-handling rules that avoid leaking sensitive information.
Application security requirements can specify safe error messaging.
Secure architecture principles include proper exception handling.