目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2026-15573— Keycloak-services 授权绕过漏洞

CVSS 8.1 · High

可能的 ATT&CK 技术 1AI

T1078.001 · Default Accounts

影响版本矩阵 14

厂商产品版本范围状态
Red HatRed Hat build of Keycloak 26.426.4.14-1< *unaffected
26.4-22< *unaffected
26.4-22< *unaffected
Red HatRed Hat build of Keycloak 26.4.14全部unaffected
全部unaffected
Red HatRed Hat build of Keycloak 26.626.6.5-1< *unaffected
26.6-11< *unaffected
26.6-11< *unaffected
Red HatRed Hat build of Keycloak 26.6.5全部unaffected
全部unaffected
全部unaffected
Red HatRed Hat Data Grid 8全部affected
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack全部affected
Red HatRed Hat Single Sign-On 7全部affected
获取后续新漏洞提醒登录后订阅

一、 漏洞 CVE-2026-15573 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
来源: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5

受影响产品

厂商产品影响版本CPE订阅
Red HatRed Hat build of Keycloak 26.4 26.4.14-1 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4 26.4-22 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4 26.4-22 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4.14-cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4.14-cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.6 26.6.5-1 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6 26.6-11 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6 26.6-11 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat Data Grid 8-cpe:/a:redhat:jboss_data_grid:8
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack-cpe:/a:redhat:jbosseapxp
Red HatRed Hat Single Sign-On 7-cpe:/a:redhat:red_hat_single_sign_on:7

二、漏洞 CVE-2026-15573 的公开POC

#POC 描述源链接神龙链接
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-15573 的情报信息

请登录查看更多情报信息。

CVE-2026-15573 厂商安全公告 (4)

CVE-2026-15573 其他参考 (2)

同批安全公告 · Red Hat · 2026-08-05 · 共 14 条

CVE-2026-100909.9 CRITICAL多集群运营商订阅漏洞：命名空间编辑用户可通过应用订阅部署集群作用域的集群角色绑定，获得集群管理员权限。
CVE-2026-100599.1 CRITICALCluster-curator-controller命名空间管理员可通过服务账户令牌提升为集群级管理员权限
CVE-2026-155728.8 HIGHKeycloak-services DCR协议映射器类型交换策略绕过导致权限提升漏洞
CVE-2026-161028.1 HIGHKeycloak-services 默认策略允许通过用户属性映射伪造角色
CVE-2026-164427.4 HIGHKeycloak saml idp initiated broker登录绕过链接限制
CVE-2026-164437.4 HIGHKeycloak-services SAML元数据导入禁用响应签名验证
CVE-2026-712267.3 HIGHLibkcapi 一次 AIO 路径错误内存损坏漏洞
CVE-2026-493316.5 MEDIUMOpenShift oauth-proxy 未授权身份头注入漏洞
CVE-2026-161006.5 MEDIUMKeycloak-services用户事件指标无界基数漏洞
CVE-2026-712256.5 MEDIUMLibkcapi 对称分块加密IV重用导致状态重置漏洞
CVE-2026-446055.5 MEDIUMRpm ndb槽表解析堆缓冲区溢出漏洞
CVE-2026-160715.4 MEDIUMKeycloak-services LDAP用户搜索绕过配置的用户DN边界漏洞
CVE-2026-712275.1 MEDIUMLibkcapi 无限循环拒绝服务漏洞

IV. Related Vulnerabilities

Same product: Red Hat build of Keycloak 26.4
Same vendor: Red Hat

V. Comments for CVE-2026-15573

暂无评论

发表评论