CVE-2026-7307Keycloak: keycloak: denial of service via specially crafted saml input

Description

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

Timeline

Scores

EPSS (exploitation in 30 days)

0.88% · top 40% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• keycloak

  • affected < 26.2.16
  • affected < 26.4.12
  • affected < 26.6.2

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2.16-1 – < *

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2-21 – < *

• Red Hat · Red Hat build of Keycloak 26.2

  • unaffected 26.2-21 – < *

• Red Hat · Red Hat build of Keycloak 26.2.16

  All versions: unaffected

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4.12-1 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-17 – < *

• Red Hat · Red Hat build of Keycloak 26.4

  • unaffected 26.4-17 – < *

• Red Hat · Red Hat build of Keycloak 26.4.12

  All versions: unaffected

• Red Hat · Red Hat Single Sign-On 7.6.13

  All versions: unaffected

• Red Hat · Red Hat Single Sign-On 7.6 for RHEL 7

  • unaffected 0:18.0.20-1.redhat_00001.1.el7sso – < *

• Red Hat · Red Hat Single Sign-On 7.6 for RHEL 8

  • unaffected 0:18.0.20-1.redhat_00001.1.el8sso – < *

• Red Hat · Red Hat Single Sign-On 7.6 for RHEL 9

  • unaffected 0:18.0.20-1.redhat_00001.1.el9sso – < *

• Red Hat · RHEL-8 based Middleware Containers

  • unaffected 7.6-85 – < *

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.keycloak:keycloak-saml-coreGHSA-p5mv-gj8j-xqgf (opens in a new tab)

What to do

Workaround: To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint to trusted networks and clients. Implement firewall rules to limit inbound connections to the Keycloak service port (e.g., 8080) from untrusted sources. If the SAML protocol is not required for your deployment, consider disabling it to eliminate the attack surface. Applying these network restrictions or configuration changes may necessitate a restart or reload of the Keycloak service, which could temporarily affect its availability.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-30883 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-p5mv-gj8j-xqgf (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-7307](https://cveledger.app/badge/CVE-2026-7307.svg)](https://cveledger.app/cve/CVE-2026-7307)

Record last updated 6 Oct 2026, 16:43 UTC.