CVE-2026-9791: Keycloak Information Disclosure Vulnerability

CVE-2026-9791 Overview

CVE-2026-9791 is an authorization flaw in Keycloak, the open-source identity and access management solution maintained by Red Hat. An authenticated user with existing organization membership can retrieve organization metadata through user-facing APIs, including the account API and OpenID Connect (OIDC) token requests using the organization scope. The flaw persists even after administrators explicitly disable the Organizations feature. Downstream resource servers consuming these tokens may make incorrect authorization decisions based on the leaked metadata. The weakness is classified as Incorrect Authorization [CWE-863].

Critical Impact

Disabled feature flags do not suppress organization metadata in issued tokens, undermining trust in feature-toggle-based access control.

Affected Products

• Red Hat Keycloak
• Red Hat Build of Keycloak
• Red Hat Single Sign-On (downstream distributions referencing the upstream Keycloak codebase)

Discovery Timeline

• 2026-05-28 - CVE-2026-9791 published to the National Vulnerability Database
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9791

Vulnerability Analysis

The vulnerability resides in how Keycloak handles the Organizations feature toggle. Administrators can disable the Organizations feature through server configuration, expecting that organization-related claims and APIs become inert. The flaw breaks that assumption. Authenticated users retain the ability to query the account API and request OIDC tokens scoped with organization, and Keycloak continues to embed organization membership metadata in the responses.

This behavior creates a divergence between the administrator's stated security posture and the data actually leaving the identity provider. Resource servers that gate functionality on the presence or content of organization claims will receive populated values when they should receive none. The impact is limited to confidentiality of organization metadata; integrity and availability are not affected.

Root Cause

The root cause is incorrect authorization enforcement around the Organizations feature flag. Token issuance and account API handlers do not consult the feature-disabled state before populating organization claims, so metadata flows to clients regardless of administrative intent.

Attack Vector

Exploitation requires an authenticated session and existing organization membership. The attacker calls the account API or requests an OIDC token using the organization scope. No special privileges, user interaction, or local access are required. The disclosed metadata can be replayed against resource servers that rely on these claims for authorization, leading to access decisions the administrator intended to remove by disabling the feature.

Verified exploit code is not publicly available. Refer to the Red Hat CVE-2026-9791 Advisory and the Red Hat Bug Report #2482458 for upstream technical details.

Detection Methods for CVE-2026-9791

Indicators of Compromise

• OIDC token requests from authenticated users containing the organization scope on realms where the Organizations feature is configured as disabled.
• Account API responses returning populated organization membership fields after an administrative disable action.
• Resource server logs showing authorization decisions based on organization claims that should not be present.

Detection Strategies

• Audit Keycloak EVENT logs for TOKEN_EXCHANGE and CODE_TO_TOKEN events that include the organization scope and correlate with realms where the feature is administratively disabled.
• Inspect issued JWTs for organization claims using a token introspection workflow and flag tokens emitted by realms with the feature toggle off.
• Compare realm configuration state against token contents on a recurring basis to catch divergence between policy and runtime behavior.

Monitoring Recommendations

• Forward Keycloak admin and user events to a centralized log platform and alert on organization scope grants in realms expected to be free of organization data.
• Monitor account API endpoints (/realms/{realm}/account) for response bodies containing organization fields and baseline normal versus anomalous response shapes.
• Track configuration drift of the Organizations feature flag through infrastructure-as-code change detection.

How to Mitigate CVE-2026-9791

Immediate Actions Required

• Apply the Keycloak update referenced in the Red Hat CVE-2026-9791 Advisory once available for your distribution.
• Inventory clients that request the organization scope and confirm whether each client legitimately requires organization claims.
• Rotate or invalidate active sessions for users with organization membership after patching to flush cached tokens that still carry leaked metadata.

Patch Information

Red Hat tracks remediation under the advisory linked above. Consult the vendor advisory for fixed package versions specific to Red Hat Build of Keycloak and Red Hat Single Sign-On. Upstream Keycloak users should track the corresponding release notes for the version that aligns the feature toggle with token issuance and account API behavior.

Workarounds

• Remove the organization scope from client scope mappings on affected realms so tokens cannot be issued with that scope.
• Strip or ignore organization claims at the resource server boundary until the patched version is deployed.
• Restrict account API access through a reverse proxy or API gateway policy that filters organization-related response fields.

# Configuration example: remove organization scope from a client via kcadm
kcadm.sh remove-roles \
  --uusername service-account-myclient \
  --cclientid realm-management \
  --rolename view-organizations

# Disable the organization scope assignment on the client
kcadm.sh update clients/<client-uuid>/default-client-scopes/<organization-scope-uuid> \
  -r <realm> --no-merge