CVE-2026-2092
published 2026-03-18CVE-2026-2092: A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the…
PriorityP352high7.7CVSS 3.1
AVNACHPRLUINSCCHILAL
EPSS
0.37%
30.2th percentile
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langroid | langroid | >= 0 < 0.59.32 | 0.59.32 |
| redhat | build_of_keycloak | >= 26.2 < 26.2.14 | 26.2.14 |
| redhat | build_of_keycloak | >= 26.4 < 26.4.10 | 26.4.10 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
ghsa9.8CRITICAL
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
ghsa·2026-07-02
CVE-2026-2092 [HIGH] CWE-1287 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
OSV
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
osv·2026-03-18
CVE-2026-2092 [HIGH] Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GHSA
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
ghsa·2026-03-18
CVE-2026-2092 [HIGH] CWE-1287 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GHSA
Langroid has WAF Bypass Leading to RCE in TableChatAgent
ghsa·2026-02-02·CVSS 9.8
CVE-2026-25481 [CRITICAL] CWE-94 Langroid has WAF Bypass Leading to RCE in TableChatAgent
Langroid has WAF Bypass Leading to RCE in TableChatAgent
## Affected Scope
langroid
## Gadget
pandas_eval (langroid\agent\special\table_chat_agent.py:239)
handle_tool_message (langroid\agent\base.py:2092)
handle_message (langroid\agent\base.py:1744)
agent_response (langroid\agent\base.py:760)
response (langroid\agent\task.py:1584)
step (langroid\agent\task.py:1261)
run (langroid\agent\task.py:827)
## Security Impact
Remote Code Execution (RCE) via `pandas_eval` tool. Attackers can execute arbitrary shell commands through controlled user input.
Red Hat
keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
vendor_redhat·2026-03-05·CVSS 7.7
CVE-2026-2092 [HIGH] CWE-1287 keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can e
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-2092 keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
bugzilla·2026-02-06·CVSS 7.7
CVE-2026-2092 [HIGH] CVE-2026-2092 keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE-2026-2092 keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak validates that plaintext `` elements are signed when the response root is not signed, but it does not apply the same binding requirement to ``. The saml broker endpoint then decrypts and processes the first assertion choice, which allows an attacker to inject an encrypted assertion for an arbitrary principal alongside a valid signed assertion for themselves. So the response can be crafted in the following way:
Remove the signature for the full response if present.
Get the public key of the realm to encrypt the new assertion.
Put this encrypted assertion first.
Maintain the second assertion that should be signed and valid.
This way Keycloak method validates the sign
Wiz
CVE-2026-2092 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.7
CVE-2026-2092 [HIGH] CVE-2026-2092 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-2092 :
Java vulnerability analysis and mitigation
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
Source : NVD
## 7.7
Score
Published March 18, 2026
Severity HIGH
CNA Score 7.7
Affected Technologies
Java
Keycloak
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 23.3
Exploitatio
https://access.redhat.com/errata/RHSA-2026:3925https://access.redhat.com/errata/RHSA-2026:3926https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/errata/RHSA-2026:76128https://access.redhat.com/errata/RHSA-2026:76129https://access.redhat.com/errata/RHSA-2026:76130https://access.redhat.com/errata/RHSA-2026:76132https://access.redhat.com/errata/RHSA-2026:76134https://access.redhat.com/security/cve/CVE-2026-2092https://bugzilla.redhat.com/show_bug.cgi?id=2437296https://access.redhat.com/errata/RHSA-2026:3925https://access.redhat.com/errata/RHSA-2026:3926https://access.redhat.com/errata/RHSA-2026:3947https://access.redhat.com/errata/RHSA-2026:3948https://access.redhat.com/security/cve/CVE-2026-2092https://bugzilla.redhat.com/show_bug.cgi?id=2437296https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2092.json
2026-03-18
Published