CVE-2026-74909Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Cloud-IAM@cloud_iam_com46d
Disclosure
CVE-2026-74909 (8.1): The policy enforcer that match requests against defined security policies failed to correctly handle web addresses with special encoded chars. An user could trick the enforcer into applying a less restrictive policy to gain access to some endpoints.
Post summary
The text is a brief vulnerability disclosure for CVE-2026-74909 (CVSS 8.1) describing a policy enforcer bypass via special encoded characters, with no PoC, exploit, patch, or active exploitation details.
1002046
215 followersView on X

Explore more

Back to dashboard