目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2026-16102— Keycloak-services 默认策略允许通过用户属性映射伪造角色

CVSS 8.1 · High

影响版本矩阵 14

厂商产品版本范围状态
Red HatRed Hat build of Keycloak 26.426.4.14-1< *unaffected
26.4-22< *unaffected
26.4-22< *unaffected
Red HatRed Hat build of Keycloak 26.4.14全部unaffected
全部unaffected
Red HatRed Hat build of Keycloak 26.626.6.5-1< *unaffected
26.6-11< *unaffected
26.6-11< *unaffected
Red HatRed Hat build of Keycloak 26.6.5全部unaffected
全部unaffected
全部unaffected
Red HatRed Hat Data Grid 8全部affected
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack全部affected
Red HatRed Hat Single Sign-On 7全部affected
获取后续新漏洞提醒登录后订阅

一、 漏洞 CVE-2026-16102 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
来源: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5

受影响产品

厂商产品影响版本CPE订阅
Red HatRed Hat build of Keycloak 26.4 26.4.14-1 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4 26.4-22 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4 26.4-22 ~ * cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4.14-cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.4.14-cpe:/a:redhat:build_keycloak:26.4::el9
Red HatRed Hat build of Keycloak 26.6 26.6.5-1 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6 26.6-11 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6 26.6-11 ~ * cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat build of Keycloak 26.6.5-cpe:/a:redhat:build_keycloak:26.6::el9
Red HatRed Hat Data Grid 8-cpe:/a:redhat:jboss_data_grid:8
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack-cpe:/a:redhat:jbosseapxp
Red HatRed Hat Single Sign-On 7-cpe:/a:redhat:red_hat_single_sign_on:7

二、漏洞 CVE-2026-16102 的公开POC

#POC 描述源链接神龙链接
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-16102 的情报信息

请登录查看更多情报信息。

CVE-2026-16102 厂商安全公告 (3)

CVE-2026-16102 其他参考 (3)

同批安全公告 · Red Hat · 2026-08-05 · 共 14 条

CVE-2026-100909.9 CRITICAL多集群运营商订阅漏洞：命名空间编辑用户可通过应用订阅部署集群作用域的集群角色绑定，获得集群管理员权限。
CVE-2026-100599.1 CRITICALCluster-curator-controller命名空间管理员可通过服务账户令牌提升为集群级管理员权限
CVE-2026-155728.8 HIGHKeycloak-services DCR协议映射器类型交换策略绕过导致权限提升漏洞
CVE-2026-155738.1 HIGHKeycloak-services 授权绕过漏洞
CVE-2026-164427.4 HIGHKeycloak saml idp initiated broker登录绕过链接限制
CVE-2026-164437.4 HIGHKeycloak-services SAML元数据导入禁用响应签名验证
CVE-2026-712267.3 HIGHLibkcapi 一次 AIO 路径错误内存损坏漏洞
CVE-2026-493316.5 MEDIUMOpenShift oauth-proxy 未授权身份头注入漏洞
CVE-2026-161006.5 MEDIUMKeycloak-services用户事件指标无界基数漏洞
CVE-2026-712256.5 MEDIUMLibkcapi 对称分块加密IV重用导致状态重置漏洞
CVE-2026-446055.5 MEDIUMRpm ndb槽表解析堆缓冲区溢出漏洞
CVE-2026-160715.4 MEDIUMKeycloak-services LDAP用户搜索绕过配置的用户DN边界漏洞
CVE-2026-712275.1 MEDIUMLibkcapi 无限循环拒绝服务漏洞

IV. Related Vulnerabilities

Same product: Red Hat build of Keycloak 26.4
Same vendor: Red Hat

V. Comments for CVE-2026-16102

暂无评论

发表评论