CVE-2026-9705— Keycloak 会话机制问题漏洞
Possible ATT&CK Techniques 3AI
T1528 · Steal Application Access Token T1078 · Valid Accounts T1136.001 · Local AccountAffected Version Matrix 8
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.13-1< * | unaffected |
26.4-19< * | unaffected | ||
26.4-19< * | unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.4.13 | any | unaffected |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.4-2< * | unaffected |
26.6-8< * | unaffected | ||
26.6-8< * | unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.6.4 | any | unaffected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-9705の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
ソース: CVE Program / CVE List V5
脆弱性説明
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
不充分的会话过期机制
ソース: CVE Program / CVE List V5
脆弱性タイトル
Keycloak 会话机制问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Keycloak是Keycloak组织开源的一种开源身份和访问管理解决方案。 Keycloak存在会话机制问题漏洞，该漏洞源于客户端注册服务问题，可能导致持有先前已颁发注册访问令牌(RAT)的远程攻击者重新启用管理员已禁用的客户端，绕过安全控制，重置客户端密钥并获得特权API访问权限。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.13-1 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4.13 | - | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.4-2 ~ * | cpe:/a:redhat:build_keycloak:26.6::el9 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-8 ~ * | cpe:/a:redhat:build_keycloak:26.6::el9 | |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-8 ~ * | cpe:/a:redhat:build_keycloak:26.6::el9 | |
| Red Hat | Red Hat build of Keycloak 26.6.4 | - | cpe:/a:redhat:build_keycloak:26.6::el9 |
II. CVE-2026-9705の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-9705のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-9705 厂商安全公告 (1)
CVE-2026-9705 其他参考 (5)
Same Patch Batch · Red Hat · 2026-06-25 · 13 CVEs total
| CVE-2026-12975 | 8.5 HIGH | Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detect |
| CVE-2026-9800 | 8.1 HIGH | Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri |
| CVE-2026-11800 | 8.1 HIGH | Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusio |
| CVE-2026-9099 | 7.7 HIGH | Keycloak: group-admin escalation to realm-admin |
| CVE-2026-12992 | 7.4 HIGH | Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl |
| CVE-2026-9086 | 7.3 HIGH | Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass |
| CVE-2026-13083 | 6.9 MEDIUM | Pen-drive: pen-drive: stored xss via unescaped cluster data in html report |
| CVE-2026-12993 | 6.5 MEDIUM | Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via |
| CVE-2026-13318 | 6.4 MEDIUM | Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-ag |
| CVE-2026-9083 | 4.9 MEDIUM | Keycloak: keycloak: information disclosure through arbitrary filesystem path probing |
| CVE-2026-9799 | 4.6 MEDIUM | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass |
| CVE-2026-13218 | 4.2 MEDIUM | Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from |
IV. 関連脆弱性
- CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper ty - CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated bro - CVE-2026-16071
Keycloak-services: keycloak-services: ldap entry-dn user sea - CVE-2026-16102
Keycloak-services: keycloak-services: default dcr policy all - CVE-2026-15573
Keycloak-services: keycloak-services: authorization bypass v
同じベンダー: Red Hat
- CVE-2026-66780
Submariner-operator: submariner-operator: flat broker trust - CVE-2026-66783
Submariner-operator: submariner-operator: arbitrary image ov - CVE-2026-66782
Submariner-operator: submariner-operator: broker api bearer - CVE-2026-66781
Submariner-operator: submariner-operator: ipsec psk stored c - CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun
同じ弱点: CWE-613
- CVE-2026-45791
Dokploy: Password Change Does Not Revoke Active Sessions - CVE-2026-73611
File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass - CVE-2026-66376
Deleted users may temporarily retain access to JFrog Artifac - CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account - CVE-2026-48079
OpenReception's logout page clears local access_token before
V. CVE-2026-9705へのコメント
まだコメントはありません