CVE-2026-7307: Keycloak denial of service in SAML endpoint

CVE-2026-7307 · Severity: high · CVSS 7.5 · Published 2026-05-19

Keycloak, a widely used identity and access management solution, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send malicious login requests that overwhelm the server's processor and exhaust its available worker threads. This can cause the authentication service to become completely unresponsive, preventing legitimate users from logging into their applications and disrupting business operations.

Technologies: Keycloak, org.keycloak:keycloak-saml-core (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-7307 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7307 being exploited in the wild.
How severe is CVE-2026-7307?
High severity, with a CVSS score of 7.5, published 19 May 2026.
Which products and versions are affected?
Keycloak < 26.6.2; org.keycloak:keycloak-saml-core (Maven) < 26.6.2, ECOSYSTEM:introduced=0,fixed=26.6.2; Red Hat build of Keycloak 26.2.x < 26.2.16, 26.4.x < 26.4.12.
Is there a fix for CVE-2026-7307?
Yes. org.keycloak:keycloak-saml-core (Maven): upgrade to 26.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7307 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-7307?
Check whether you run Keycloak, org.keycloak:keycloak-saml-core (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-saml-core (Maven): upgrade to 26.6.2 or later
    # set org.keycloak:keycloak-saml-core to 26.6.2 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Keycloak's SAML implementation due to improper validation of syntactic correctness in XML input (CWE-1286). A remote, unauthenticated attacker can exploit this by sending a specially crafted XML payload to the Security Assertion Markup Language (SAML) endpoint. The processing of this malicious input triggers excessive CPU consumption and worker thread starvation. This leads to a Denial of Service (DoS) condition where the server is unable to process further requests. The issue is resolved in Keycloak version 26.6.2 and corresponding Red Hat build updates.

Affected products

  • Keycloak Keycloak < 26.6.2
  • Red Hat Red Hat build of Keycloak 26.2.x < 26.2.16, 26.4.x < 26.4.12

Identifiers

  • CVE-2026-7307
  • GHSA-p5mv-gj8j-xqgf

Timeline

  • 2026-05-12: other: Initial report in Red Hat Bugzilla
  • 2026-05-19: disclosed: CVE-2026-7307 published
  • 2026-05-19: advisory: GitHub Advisory GHSA-p5mv-gj8j-xqgf published
  • 2026-05-20: patched: Red Hat released security updates (RHSA-2026:19594, RHSA-2026:19597)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.