CVE-2026-19608— Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19608
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - | cpe:/a:redhat:build_keycloak: | |
| Red Hat | Red Hat Build of Keycloak | - | cpe:/a:redhat:build_keycloak: | |
| Red Hat | Red Hat Single Sign-On 7 | - | cpe:/a:redhat:red_hat_single_sign_on:7 |
II. Public POCs for CVE-2026-19608
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19608
请登录查看更多情报信息。
Other References for CVE-2026-19608 (1)
Same Patch Batch · Red Hat · 2026-08-18 · 3 CVEs total
| CVE-2026-66793 | 8.8 HIGH | Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary containe |
| CVE-2026-75032 | 6.3 MEDIUM | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder |
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
- CVE-2026-18967
Keycloak-services: keycloak-services: saml onetimeuse assert - CVE-2026-18569
Keycloak-services: keycloak-services: oidc backchannel logou - CVE-2026-18573
Keycloak-services: keycloak-services: client access-type pol - CVE-2026-18572
Keycloak-services: keycloak-services: uma claim token can ov - CVE-2026-18571
Keycloak-services: keycloak-services: fgap v2 group assignme
Same vendor: Red Hat
- CVE-2026-66793
Governance-policy-addon-controller: governance-policy-addon- - CVE-2026-75032
Bluez: bluez: out-of-bounds read in avrcp parse_media_elemen - CVE-2026-66795
Managedcluster-import-controller: managedcluster-import-cont - CVE-2026-71472
Acm-search-v2-rhel9: search-v2-operator: shell-command and s - CVE-2026-70495
Search-v2-operator: search-v2-operator: cluster-wide imperso
Same weakness: CWE-285
- CVE-2024-14045
OpenBoxes Product Supplier Edit Controller RoleInterceptor.g - CVE-2026-19986
Adblock for Youtube Extension Event Listener contentscript.j - CVE-2026-16879
IBM Db2 Mirror for i is affected by multiple vulnerabilities - CVE-2026-73421
NextAuth.js: Configuration errors can cause existence-based - CVE-2026-18509
IBM i is Affected By A Prvilege Escalation Vulnerability []
V. Comments for CVE-2026-19608
No comments yet