CVE-2026-9088: Keycloak information disclosure via user profile permission bypass in group members endpoint

CVE-2026-9088 · Severity: low · CVSS 3.1 · Published 2026-06-05

Keycloak is an open-source identity and access management solution used to secure applications and services. A security flaw allows administrators with limited permissions to bypass profile restrictions and view sensitive user information they are not authorized to see. This could lead to the exposure of private user attributes, potentially compromising user privacy or organizational data policies.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak 26.4. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9088 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9088 being exploited in the wild.
How severe is CVE-2026-9088?
Low severity, with a CVSS score of 3.1, published 5 June 2026.
Which products and versions are affected?
Keycloak < 26.7.0; org.keycloak:keycloak-services (Maven) < 26.7.0, ECOSYSTEM:introduced=0,fixed=26.7.0; Red Hat build of Keycloak 26.4 < 26.4.13-1; Red Hat build of Keycloak 26.6 < 26.6.3-3.
Is there a fix for CVE-2026-9088?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9088 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9088?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak 26.4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.7.0 or later
    # set org.keycloak:keycloak-services to 26.7.0 in your pom.xml or build.gradle

Technical details

An information disclosure vulnerability exists in org.keycloak.services due to insufficient granularity of access control (CWE-1220). An administrator with delegated permissions to read group memberships and users can bypass configured user profile permissions by querying the group members endpoint. This allows the attacker to retrieve user attributes that are explicitly configured to be denied or hidden. The attack requires high privileges (delegated admin access) and is reachable over the network without user interaction. The issue is resolved in Keycloak version 26.7.0 and various Red Hat build of Keycloak maintenance releases.

Affected products

  • Keycloak Keycloak < 26.7.0
  • Red Hat Red Hat build of Keycloak 26.6 < 26.6.3-3
  • Red Hat Red Hat build of Keycloak 26.4 < 26.4.13-1

Identifiers

  • CVE-2026-9088
  • GHSA-6g26-7cx5-mrrg

Timeline

  • 2026-05-20: disclosed: Initial report in Red Hat Bugzilla
  • 2026-06-05: advisory: GitHub Advisory and NVD entry published
  • 2026-06-10: patched: Red Hat released security advisories for patched versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.