CVE-2026-94217 Red Hat CVE debrief

Who should care

Defenders responsible for Keycloak deployments, particularly those with multiple users and resources, should assess exposure and implement compensating controls. Security teams and vulnerability management teams should prioritize verifying affected versions, assessing exposure, and implementing mitigations to prevent unauthorized access to resources.

Why it matters

Defenders should care about CVE-2026-94217 because it can lead to unauthorized access to resources in Keycloak deployments. The flaw requires verification of affected versions and configurations, assessment of exposure, and implementation of compensating controls.

• Potential unauthorized access to victim's resource
• Incorrect permission merging for resources with same name

Technical summary

The flaw occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared. The issue affects Keycloak deployments with multiple users and resources, requiring verification of affected versions and configurations to assess exposure.

Defensive priority

Defenders should prioritize verifying affected versions and configurations, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify Keycloak versions and configurations for exposure
• Assess access control and resource ownership
• Implement compensating controls for resource access
• Review official advisories for remediation guidance
• Monitor for suspicious activity related to authorization tokens
• Conduct regular security audits to identify potential vulnerabilities
• Consider implementing additional security measures such as multi-factor authentication

Evidence notes

The CVE record and NVD entry provide limited information about affected versions and remediation. Further verification is required to assess exposure and implement compensating controls. Keycloak deployments with multiple users and resources are potentially vulnerable. Defenders should review official advisories and consider additional security measures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.