CVE-2026-15573
published 2026-08-05CVE-2026-15573: A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not…
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.46%
38.8th percentile
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keycloak | rhbk-openshift-rhel9 | — | — |
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| redhat | data_grid | — | — |
| redhat | single_sign-on | — | — |
| rhbk-openshift-rhel9 | rhbk-openshift-rhel9 | — | — |
| rhbk | keycloak-operator-bundle_26.4.14-1 | — | — |
| rhbk | keycloak-operator-bundle_26.4.16-2 | — | — |
| rhbk | keycloak-operator-bundle_26.6.5-1 | — | — |
| rhbk | keycloak-operator-bundle_26.6.7-3 | — | — |
| rhbk | keycloak-rhel9 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-22 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-26 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-11 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-20 | — | — |
| rhbk | keycloak-rhel9_26.4-22 | — | — |
| rhbk | keycloak-rhel9_26.4-26 | — | — |
| rhbk | keycloak-rhel9_26.6-11 | — | — |
| rhbk | keycloak-rhel9_26.6-20 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
vendor_redhat·2026-09-16·CVSS 8.1
CVE-2026-74909 [HIGH] CWE-862 keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
Keycloak provides a policy enforcer to protect applications by matching incoming web requests agains
Red Hat
keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
vendor_redhat·2026-08-05·CVSS 8.1
CVE-2026-15573 [HIGH] keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
Statement: Red Hat Product Security has rated this vulnerability as having a security impact of Important. This issue allows authenticated users to bypass fine-grained authorization controls by exploitin
GHSA
A flaw was found in Keycloak's Authorization Services.
ghsa_unreviewed·2026-08-05
CVE-2026-15573 [HIGH] CWE-178 A flaw was found in Keycloak's Authorization Services.
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-74909 keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
bugzilla·2026-08-17·CVSS 8.1
CVE-2026-74909 [HIGH] CVE-2026-74909 keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
CVE-2026-74909 keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
An incomplete fix for CVE-2026-15573 in Keycloak PathMatcher allows an authenticated attacker to bypass authorization policies. The original fix introduced URI normalization to strip matrix parameters and resolve dot segments, but this cleanup occurs before percent-decoding. Consequently, percent-encoded semicolons (percent-3B) and percent-encoded dot segments (percent-2Epercent-2E) bypass the normalization logic. When the Keycloak policy enforcer is used with a servlet container that decodes these characters during routing (such as Tomcat or WildFly), the enforcer matches the request against a permissive catch-all resource while the contain
Bugzilla
CVE-2026-15573 keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
bugzilla·2026-07-13·CVSS 8.1
CVE-2026-15573 [HIGH] CVE-2026-15573 keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
CVE-2026-15573 keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher
Keycloak Authorization Services resolves request URIs to protected Resources using PathMatcher (org.keycloak.common.util.PathMatcher), which performs purely lexical segment comparison with no URI normalization. Appending a matrix parameter (;x=1) or trailing / to a restricted resource URI causes it to miss the exact match and fall through to a broader, more permissive resource (e.g., the default /* catch-all).
An authenticated low-privilege user can obtain a granted RPT or positive authorization decision for resources the policy explicitly denies them. The vulnerability affects the UMA grant endpoint, the Protection API matchingUri resolution, and the client-side policy e
2026-08-05
Published