PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2366 Red Hat CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record for CVE-2026-2366 was published on 2026-03-12T11:15:55.860Z. This vulnerability is an authorization bypass issue in the Keycloak Admin API, allowing any authenticated user to enumerate organization memberships of other users if they know the victim's unique identifier (UUID) and the Organizations feature is enabled. The vulnerability has a CVSS score of 3.1 and is classified as LOW severity. Administrators and users of Keycloak instances, especially those with the Organizations feature enabled, should be aware of this vulnerability and take necessary precautions to protect against potential enumeration attacks. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, remediated assets should be retested, and the item should only be closed after evidence is documented.

Vendor
Red Hat
Product
Red Hat build of Keycloak 26.4
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-12
Original CVE updated
2026-08-18
Advisory published
2026-03-12
Advisory updated
2026-08-18

Who should care

Administrators and users of Keycloak instances, especially those with the Organizations feature enabled, should be aware of this vulnerability and take necessary precautions to protect against potential enumeration attacks.

Technical summary

CVE-2026-2366 is an authorization bypass vulnerability in the Keycloak Admin API. An authenticated user with low privileges can enumerate organization memberships of other users if they know the victim's unique identifier (UUID) and the Organizations feature is enabled. The vulnerability has a CVSS score of 3.1 and is classified as LOW severity. This issue affects Keycloak instances with the Organizations feature enabled. To address this vulnerability, it is recommended to inventory and verify affected Keycloak instances, implement compensating controls to monitor and restrict access to sensitive user information, apply vendor patches or updates as available, restrict access to the Keycloak Admin API to only necessary personnel, and monitor for unusual activity related to user enumeration and organization membership queries. Affected product context includes Keycloak version 26.4 up to but not including 26.4.11. Defensive impact involves potential enumeration of organization memberships by authenticated users with low privileges. Source-grounded technical framing emphasizes the importance of validating user privileges and restricting access to sensitive information.

Defensive priority

Authenticated users with low privileges can potentially enumerate organization memberships of other users if they know the victim's UUID and the Organizations feature is enabled.

Recommended defensive actions

  • Inventory and verify affected Keycloak instances, specifically version 26.4 up to but not including 26.4.11.
  • Implement compensating controls to monitor and restrict access to sensitive user information.
  • Apply vendor patches or updates as available.
  • Restrict access to the Keycloak Admin API to only necessary personnel.
  • Monitor for unusual activity related to user enumeration and organization membership queries.

Evidence notes

The CVE-2026-2366 record indicates an authorization bypass vulnerability in Keycloak's Admin API, allowing enumeration of organization memberships for users with known UUIDs when the Organizations feature is enabled. Official records show a CVSS score of 3.1 and LOW severity. Red Hat provides advisories RHSA-2026:6477, RHSA-2026:6478, and a dedicated CVE page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2366 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2366

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2366 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2366

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.