CVE-2026-3047 Red Hat CVE debrief

Who should care

Security teams and administrators responsible for Redhat Build Of Keycloak deployments should be aware of this vulnerability and take immediate action to mitigate the risk. This flaw can be exploited by remote attackers to gain unauthorized access to sensitive systems and data. Organizations using affected versions of Redhat Build Of Keycloak should prioritize patching and updating their systems to prevent potential attacks.

Technical summary

The vulnerability is caused by a flaw in the org.keycloak.broker.saml module, which allows a disabled SAML client to still complete the login process and establish an SSO session. This is possible because the SAML client is configured as an Identity Provider (IdP)-initiated broker landing target. An attacker can exploit this flaw to bypass security restrictions and gain unauthorized access to other enabled clients without re-authentication. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

High priority should be given to patching and updating affected Redhat Build Of Keycloak deployments. Security teams should work closely with system administrators to ensure that all necessary patches are applied and that systems are properly configured to prevent exploitation.

Recommended defensive actions

• Apply patches and updates released by Redhat to address CVE-2026-3047
• Review and update SAML client configurations to prevent exploitation
• Monitor system logs and security events for potential attacks
• Implement additional security controls, such as multi-factor authentication, to reduce the risk of exploitation
• Conduct regular security assessments and penetration testing to identify potential vulnerabilities

Evidence notes

The CVE-2026-3047 record was published on March 5, 2026, and last modified on June 30, 2026. The vulnerability has a CVSS score of 8.8 and is considered a high-risk vulnerability. Redhat has released several advisories and patches to address this vulnerability, including RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, and RHSA-2026:3948.

Official resources