CVE-2026-105302 Red Hat CVE debrief

Who should care

Defenders managing Keycloak instances, delegated client administrators, and security teams responsible for monitoring and mitigating potential data leaks should be aware of this vulnerability and its implications.

Why it matters

CVE-2026-105302 is a medium-severity vulnerability in Keycloak's User Session Note mapper that could allow delegated client administrators to leak user bearer tokens, potentially leading to unauthorized access to user data on external platforms. Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Keycloak instances and delegated client administrators. The impact is limited by the requirement for a delegated client administrator to exploit the vulnerability. Evidence is limited, and further verification is required to determine the full scope of affected systems and remediation steps.

• Potential unauthorized access to user data on external platforms.
• Exposure of sensitive internal credentials.
• Compromised tokens could lead to lateral movement within the affected systems.
• Verification of Keycloak instance configurations and User Session Note mapper settings is required.

Technical summary

The User Session Note mapper in Keycloak does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This flaw allows a delegated client administrator to potentially leak a user's upstream bearer tokens into tokens issued to their managed application. The issue is specific to Keycloak's handling of session notes and does not affect other identity and access management solutions. Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Keycloak instances and delegated client administrators.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially those managing Keycloak instances and delegated client administrators.

Recommended defensive actions

• Verify Keycloak instance configurations and User Session Note mapper settings.
• Restrict access to delegated client administrators.
• Monitor for suspicious token issuance activity.
• Apply patches or mitigations provided by the vendor.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in Keycloak's User Session Note mapper. Red Hat has a reference to this CVE, indicating potential impact on their products. Evidence is limited, and further verification is required to determine the full scope of affected systems and remediation steps. Defenders should verify Keycloak instance configurations and User Session Note mapper settings. The vulnerability's impact is limited by the requirement for a delegated client administrator to exploit it.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.