Is CVE-2026-9794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9794 being exploited in the wild.

How severe is CVE-2026-9794?

Medium severity, with a CVSS score of 5.3, published 28 May 2026.

Which products and versions are affected?

Keycloak = 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,last_affected=26.4.7; Red Hat build of Keycloak 26.4, 26.6.

Is there a fix for CVE-2026-9794?

A patch was published on 2026-06-10: Red Hat release 26.6.3 issued Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9794 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9794?

Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9794: Keycloak information disclosure in SAML ECP endpoint

Q: Which products and versions are affected?

Keycloak = 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,last_affected=26.4.7; Red Hat build of Keycloak 26.4, 26.6.

Q: Is there a fix for CVE-2026-9794?

A patch was published on 2026-06-10: Red Hat release 26.6.3 issued Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9794 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9794?

Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9794 · Severity: medium · CVSS 5.3 · Published 2026-05-28

Keycloak, an open-source identity and access management solution, contains a flaw in how it handles certain authentication requests. An unauthorized attacker can send specially crafted messages to the system and observe the resulting error messages to learn internal details about how different clients are configured. While this does not directly grant access to accounts, it provides information that could be used to plan more targeted attacks against the organization's authentication infrastructure.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak, Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9794 being exploited in the wild.
How severe is CVE-2026-9794?: Medium severity, with a CVSS score of 5.3, published 28 May 2026.
Which products and versions are affected?: Keycloak <= 26.4.7, >= 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,last_affected=26.4.7; Red Hat build of Keycloak 26.4, 26.6.
Is there a fix for CVE-2026-9794?: A patch was published on 2026-06-10: Red Hat release 26.6.3 issued Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9794 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9794?: Check whether you run Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability exists in the Keycloak SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint. A remote, unauthenticated attacker can exploit this by sending specially crafted SOAP requests with varying client IDs. By analyzing the distinct 'faultstrings' returned in the SOAP responses, the attacker can perform reconnaissance to determine the protocol type of specific clients. This information disclosure is patched in Keycloak version 26.6.3.

Affected products

Keycloak keycloak-services <= 26.4.7, >= 26.5.0, < 26.6.3
Red Hat Red Hat build of Keycloak 26.4, 26.6

Identifiers

CVE-2026-9794
GHSA-fqjh-8322-vgrv

Timeline

2026-05-28: disclosed
2026-05-28: advisory
2026-06-10: patched: Red Hat release 26.6.3 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.