CVE-2026-3047Disclosure(redhat / build_of_keycloak)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch redhat build_of_keycloak systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

redhat CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3047.json

Weakness type (CWE)

CWE-305

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

build_of_keycloak
keycloak

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 5 classified signals
Peaked 4d ago at 2 mentions (2026-03-05); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

redhat

Products

build_of_keycloakkeycloak

5 versions affected across 2 products

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Disclosure

571.4%

Patch

228.6%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-05	2	Disclosure2
2026-03-06	2	Disclosure2
2026-03-08	1	Disclosure1
2026-03-09	1	Patch1
2026-03-11	1	Patch1

Full discourse7 posts

CCB Alert@CCBalert218d
Disclosure
Warning: 2 high improper authorization & authentication bypass in #RedHat #Keycloack #SAMLbroker. CVE-2026-3047 CVE-2026-3009 CVSS: 8.8 - 8.1. A remote attacker can gain unauthorized access to the system and bypass sec restrictions due to an access ctrl enforcement error #Patch
Post summary
The bulletin announces two high‑severity RedHat Keycloak SAML broker authorization bypass flaws (CVE‑2026‑3047 and CVE‑2026‑3009) with CVSS scores of 8.8–8.1, outlining the risk of remote unauthorized access.
02011265
7.2K followersView on X
セキュリティ対策Lab@securityLab_jp214d
Patch
Keycloak、危険な脆弱性を含む4件を修正(CVE-2026-3047、CVE-2026-3009、CVE-2026-2603、CVE-2026-2092) https://rocket-boys.co.jp/security-measures-lab/keycloak-fixes-4-flaws-including-critical-cve-2026-3047-3009-2603-2092/ #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews
Post summary
The article announces that Keycloak has released patches to fix four critical CVEs.
00000142
334 followersView on X
Autumn Good@autumn_good_35215d
Patch
Keycloakで4件のSecurity fix CVE-2026-3047 CVE-2026-3009 CVE-2026-2603 CVE-2026-2092 Keycloak 26.5.5 released https://www.keycloak.org/2026/03/keycloak-2655-released
Post summary
The message announces the Keycloak 26.5.5 release that addresses four CVEs, indicating a patch update.
00000475
6.7K followersView on X
The Hacker Wire@TheHackerWire217d
Disclosure
🟠 CVE-2026-3047 - High A flaw was found in http://org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it c... https://www.thehackerwire.com/vulnerability/CVE-2026-3047/ https://t.co/ncwxchbyTj
Post summary
A high‑severity CVE‑2026‑3047 affecting Keycloak’s SAML broker has been disclosed, outlining how a disabled SAML client can be exploited as an IdP‑initiated broker landing target. No active exploitation, patch, or exploit code is mentioned.
0000059
130 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds219d
Disclosure
CVE-2026-3047 SAML Broker Authentication Bypass in Keycloak Allows Unaut... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3047 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE‑2026‑3047, a SAML Broker Authentication Bypass in Keycloak, without providing PoC, exploit, or patch details.
0000048
4.0K followersView on X
CVEFind.com@CveFindCom219d
Disclosure
[CVE-2026-3047: HIGH] Critical cyber flaw in http://org.keycloak.broker.saml allows attackers to gain unauthorized access to enabled clients during login process, bypassing security measures.#cve,CVE-2026-3047,#cybersecurity https://cvefind.com/CVE-2026-3047
Post summary
The post announces a high‑severity flaw in Keycloak’s SAML broker that lets attackers bypass authentication and gain unauthorized client access during login, but no proof‑of‑concept, exploit code, or remediation steps are disclosed.
0000051
598 followersView on X
CVE@CVEnew219d
Disclosure
CVE-2026-3047 A flaw was found in http://org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated bro… https://www.cve.org/CVERecord?id=CVE-2026-3047
Post summary
The text reports a flaw discovered in Keycloak's SAML broker but offers no technical specifics, mitigation steps, or exploitation details.
00000108
56.6K followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	redhat	build_of_keycloak	-	-	-
App	redhat	build_of_keycloak	26.2	-	-
App	redhat	build_of_keycloak	26.2.14	-	-
App	redhat	build_of_keycloak	26.4	-	-
App	redhat	build_of_keycloak	26.4.10	-	-
App	redhat	keycloak	-	-	-

Explore more

Back to dashboard redhat CVEs build_of_keycloak vulnerabilities

What researchers are saying

CVE-2026-3047

セキュリティ対策Lab[verified]@securityLab_jpPatch

The article announces that Keycloak has released patches to fix four critical CVEs.

CCB Alert@CCBalertDisclosure

The bulletin announces two high‑severity RedHat Keycloak SAML broker authorization bypass flaws (CVE‑2026‑3047 and CVE‑2026‑3009) with CVSS scores of 8.8–8.1, outlining the risk of remote unauthorized access.

Autumn Good@autumn_good_35Patch

The message announces the Keycloak 26.5.5 release that addresses four CVEs, indicating a patch update.

The Hacker Wire@TheHackerWireDisclosure

A high‑severity CVE‑2026‑3047 affecting Keycloak’s SAML broker has been disclosed, outlining how a disabled SAML client can be exploited as an IdP‑initiated broker landing target. No active exploitation, patch, or exploit code is mentioned.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE‑2026‑3047, a SAML Broker Authentication Bypass in Keycloak, without providing PoC, exploit, or patch details.

CVEFind.com@CveFindComDisclosure

The post announces a high‑severity flaw in Keycloak’s SAML broker that lets attackers bypass authentication and gain unauthorized client access during login, but no proof‑of‑concept, exploit code, or remediation steps are disclosed.

CVE@CVEnewDisclosure

The text reports a flaw discovered in Keycloak's SAML broker but offers no technical specifics, mitigation steps, or exploitation details.