CVE-2026-3190: Keycloak Server SPI Private - Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint
Summary
CVE-2026-3190: A flaw was found in Keycloak. Affects org.keycloak:keycloak-server-spi-private versions < 26.5.6. Fixed in 26.5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that enables secure authentication and authorization for applications. It provides features such as single sign-on, user federation, and social login. The affected packages, including keycloak-server-spi-private, keycloak-services, and keycloak-model-jpa, are integral components of Keycloak that facilitate its core functionalities. This vulnerability exposes Keycloak to unauthorized access to sensitive information.
Vulnerability Detail
A flaw was found in Keycloak's User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets. The endpoint fails to enforce the required 'uma_protection' role check, allowing any authenticated user with a token issued for a resource server client to enumerate all permission tickets in the system. This lack of role enforcement can lead to information disclosure, potentially exposing sensitive data to unauthorized users.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.5.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted users are granted access to the Keycloak instance until the patch is applied. Regularly review user roles and permissions to minimize the risk of unauthorized access.
Conclusion
In summary, CVE-2026-3190 is a significant vulnerability in Keycloak that can lead to unauthorized access to sensitive information. It is crucial to update the affected packages to version 26.5.6 or later to mitigate this risk. Regular monitoring and role management are also recommended to enhance security.
See every vulnerability recorded for org.keycloak:keycloak-server-spi-private →
FAQ
CVE-2026-3190 is a vulnerability in Keycloak that allows unauthorized users to access permission tickets due to missing role enforcement.
The affected packages include keycloak-server-spi-private, keycloak-services, and keycloak-model-jpa.
The vulnerability can lead to information disclosure, allowing unauthorized users to enumerate permission tickets and potentially access sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-server-spi-private.
