Is CVE-2026-3047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3047 being exploited in the wild.

How severe is CVE-2026-3047?

High severity, with a CVSS score of 8.8, published 5 March 2026.

Which products and versions are affected?

org.keycloak:keycloak-broker-saml (Maven) ECOSYSTEM:introduced=0,last_affected=1.8.1.Final; Red Hat build of Keycloak 26.2, 26.4.

Is there a fix for CVE-2026-3047?

A patch was published on 2026-03-05: Fixed in Red Hat build of Keycloak 26.2.14 and 26.4.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3047 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3047?

Check whether you run org.keycloak:keycloak-broker-saml (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3047: Keycloak SAML broker authentication bypass via disabled client

CVE-2026-3047 · Severity: high · CVSS 8.8 · Published 2026-03-05

A security flaw has been identified in Keycloak, a popular open-source identity and access management solution. The vulnerability allows a user to log in through a disabled SAML client if it is configured as a landing target for identity provider logins. Once logged in, an attacker could gain unauthorized access to other active applications and services within the same single sign-on (SSO) environment without needing to re-authenticate.

Technologies: Red Hat build of Keycloak. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-3047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3047 being exploited in the wild.
How severe is CVE-2026-3047?: High severity, with a CVSS score of 8.8, published 5 March 2026.
Which products and versions are affected?: org.keycloak:keycloak-broker-saml (Maven) ECOSYSTEM:introduced=0,last_affected=1.8.1.Final; Red Hat build of Keycloak 26.2, 26.4.
Is there a fix for CVE-2026-3047?: A patch was published on 2026-03-05: Fixed in Red Hat build of Keycloak 26.2.14 and 26.4.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3047 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3047?: Check whether you run org.keycloak:keycloak-broker-saml (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the org.keycloak.broker.saml component of Keycloak. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, the system fails to properly enforce the disabled status during the authentication flow. This allows a remote attacker with low privileges to complete the login process and establish a valid Single Sign-On (SSO) session. Consequently, the attacker can access other enabled clients within the realm without further authentication. Red Hat has released security advisories (RHSA-2026:3925, RHSA-2026:3926, RHSA-2026:3947, RHSA-2026:3948) to address this issue in Keycloak versions 26.2.14 and 26.4.10.

Affected products

Red Hat Red Hat build of Keycloak 26.2, 26.4

Identifiers

CVE-2026-3047
GHSA-8cr3-vpxx-92cx

Timeline

2026-03-05: disclosed
2026-03-05: patched: Fixed in Red Hat build of Keycloak 26.2.14 and 26.4.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.