keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes

cve CVE-2026-18572 2 sources, 2 claims · Watch

Red Hat writes:
keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes the claim

Severity: MEDIUM NVD
moderate Red Hat
CVSS: 6.5 NVD
6.5 Red Hat
Vendor: Red Hat NVD
Product: Red Hat build of Keycloak 26.6 NVD
CWE: CWE-863 NVD
CWE-863 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Timeline

2026-07-30	first spoke of it: keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes	Red Hat
2026-08-02	first spoke of it: Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times.	NVD

What it is to other things

affects	redhat/build_of_keycloak NVD
made_by	redhat NVD

In words only, so not counted until a person confirms one:

made_by	`red_hat` NVD says “Red Hat”
affects	`red_hat/red_hat_build_of_keycloak_26_6` NVD says “Red Hat · Red Hat build of Keycloak 26.6”

Every value, with what each source said and its receipt

Property Source Said Means here

Automatable

automatable

NVD

At least one of those steps needs a person.

receipt

Source: NVD
Its words: no
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	no
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

NVD

6.5

receipt

Source: NVD
Its words: 6.5
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS

cvss

Red Hat

6.5

receipt

Source: Red Hat
Its words: 6.5
Read by: field:cvss3_score
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-18572",
  "CWE": "CWE-863",
  "advisories": [
    "RHSA-2026:68277",
    "RHSA-2026:68278"
  ],
  "affected_packages": [
    "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
    "rhbk/keycloak-rhel9:26.6-20",
    "keycloak-services",
    "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "rhbk/keycloak-rhel9-operator:26.6-20",
    "rhbk/keycloak-operator-bundle:26.6.7-3"
  ],
  "bugzilla": "2509763",
  "bugzilla_description": "keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes",
  "cvss3_score": "6.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-07-30T10:07:47Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-18572.json",
  "severity": "moderate"
}

—

CVSS vector

cvss_vector

NVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

receipt

Source: NVD
Its words: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CVSS vector

cvss_vector

Red Hat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

2026-10-06 13:01 UTC	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2026-09-29 09:44 UTC	—

What the source handed over

{
  "CVE": "CVE-2026-18572",
  "CWE": "CWE-863",
  "advisories": [
    "RHSA-2026:68277",
    "RHSA-2026:68278"
  ],
  "affected_packages": [
    "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
    "rhbk/keycloak-rhel9:26.6-20",
    "keycloak-services",
    "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "rhbk/keycloak-rhel9-operator:26.6-20",
    "rhbk/keycloak-operator-bundle:26.6.7-3"
  ],
  "bugzilla": "2509763",
  "bugzilla_description": "keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes",
  "cvss3_score": "6.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-07-30T10:07:47Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-18572.json",
  "severity": "moderate"
}

—

CWE

cwe

NVD

CWE-863

receipt

Source: NVD
Its words: CWE-863
Read by: field:cve.weaknesses[].description[].value
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	CWE-863
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

CWE

cwe

Red Hat

CWE-863

receipt

Source: Red Hat
Its words: CWE-863
Read by: field:CWE
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-18572",
  "CWE": "CWE-863",
  "advisories": [
    "RHSA-2026:68277",
    "RHSA-2026:68278"
  ],
  "affected_packages": [
    "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
    "rhbk/keycloak-rhel9:26.6-20",
    "keycloak-services",
    "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "rhbk/keycloak-rhel9-operator:26.6-20",
    "rhbk/keycloak-operator-bundle:26.6.7-3"
  ],
  "bugzilla": "2509763",
  "bugzilla_description": "keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes",
  "cvss3_score": "6.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-07-30T10:07:47Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-18572.json",
  "severity": "moderate"
}

—

Exploitation

exploitation

NVD

none

No evidence of exploitation, and no public proof of concept.

receipt

Source: NVD
Its words: none
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	none
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Packages

packages

Red Hat

rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, rhbk/keycloak-rhel9:26.6-20, keycloak-services, rhbk-openshift-rhel9/rhbk-openshift-rhel9, rhbk/keycloak-rhel9-operator:26.6-20, rhbk/keycloak-operator-bundle:26.6.7-3

receipt

Source: Red Hat
Its words: rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, rhbk/keycloak-rhel9:26.6-20, keycloak-services, rhbk-openshift-rhel9/rhbk-openshift-rhel9, rhbk/keycloak-rhel9-operator:26.6-20, rhbk/keycloak-operator-bundle:26.6.7-3
Read by: field:affected_packages[]
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-18572",
  "CWE": "CWE-863",
  "advisories": [
    "RHSA-2026:68277",
    "RHSA-2026:68278"
  ],
  "affected_packages": [
    "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
    "rhbk/keycloak-rhel9:26.6-20",
    "keycloak-services",
    "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "rhbk/keycloak-rhel9-operator:26.6-20",
    "rhbk/keycloak-operator-bundle:26.6.7-3"
  ],
  "bugzilla": "2509763",
  "bugzilla_description": "keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes",
  "cvss3_score": "6.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-07-30T10:07:47Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-18572.json",
  "severity": "moderate"
}

—

Product

product

NVD

Red Hat build of Keycloak 26.6

receipt

Source: NVD
Its words: Red Hat build of Keycloak 26.6
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Red Hat build of Keycloak 26.6
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Severity

severity

NVD

MEDIUM

From 4.0 to 6.9.

receipt

Source: NVD
Its words: MEDIUM
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	MEDIUM
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

medium

Severity

severity

Red Hat

moderate

A flaw that is harder to exploit, or whose impact is limited.

receipt

Source: Red Hat
Its words: moderate
Read by: field:severity
Said since: 2026-09-29 09:44 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-18572",
  "CWE": "CWE-863",
  "advisories": [
    "RHSA-2026:68277",
    "RHSA-2026:68278"
  ],
  "affected_packages": [
    "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
    "rhbk/keycloak-rhel9:26.6-20",
    "keycloak-services",
    "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
    "rhbk/keycloak-rhel9-operator:26.6-20",
    "rhbk/keycloak-operator-bundle:26.6.7-3"
  ],
  "bugzilla": "2509763",
  "bugzilla_description": "keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes",
  "cvss3_score": "6.5",
  "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-07-30T10:07:47Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-18572.json",
  "severity": "moderate"
}

medium

Status

status

NVD

Modified

receipt

Source: NVD
Its words: Modified
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Technical impact

technical_impact

NVD

partial

The attacker gains limited control, or limited information.

receipt

Source: NVD
Its words: partial
Read by: field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since: 2026-10-06 12:29 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:29 UTC	partial
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Vendor

vendor

NVD

Red Hat

receipt

Source: NVD
Its words: Red Hat
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Red Hat
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-operator-bundle",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6.7-3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat build of Keycloak 26.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.6-20",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:26.6::el9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat build of Keycloak 26.6.7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "keycloak-services",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*",
                "matchCriteriaId": "E5C930CB-4EAD-497B-A44B-D880F2A1F85B",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times."
      }
    ],
    "id": "CVE-2026-18572",
    "lastModified": "2026-09-16T19:17:09.783",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-18572",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-03T15:51:08.005640Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-02T06:16:42.290",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68277"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:68278"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-18572"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Issue Tracking",
          "Vendor Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509763"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-863"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  }
}

—

Every claim, by kind

vulnerability

keycloak-services: keycloak-services: UMA claim token can override authorization time-policy evaluation attributes zetlyn/cve-redhat · 2026-07-30	cvss 6.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N cwe CWE-863 packages rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, rhbk/keycloak-rhel9:26.6-20, keycloak-services, rhbk-openshift-rhel9/rhbk-openshift-rhel9, rhbk/keycloak-rhel9-operator:26.6-20, rhbk/keycloak-operator-bundle:26.6.7-3 severity moderate	source
Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. zetlyn/cve-nvd · 2026-08-02	automatable no cvss 6.5 cvss_vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N cwe CWE-863 exploitation none product Red Hat build of Keycloak 26.6 severity MEDIUM status Modified technical_impact partial vendor Red Hat	source