Security readout for executives and security teams
Plain-English summary
CVE-2026-9803 is a medium-severity Keycloak denial-of-service flaw. An unauthenticated remote attacker can trigger server errors by sending malformed authorization headers to client registration endpoints. The reported impact is service availability, not data theft or privilege escalation.
Executive priority
Treat as a timely availability-risk patch for internet-exposed identity infrastructure. Prioritize exposed Keycloak environments because identity service interruptions can affect many dependent applications, even though the CVSS rating is medium and no active exploitation is cited.
Technical view
The flaw is in Keycloak's ClientRegistrationAuth component. A specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint can cause an ArrayIndexOutOfBoundsException and HTTP 500 responses. CVSS 3.1 is 5.3: network exploitable, low complexity, no privileges, no user interaction, low availability impact.
Likely exposure
Exposure is most relevant for Red Hat build of Keycloak 26.4 and 26.6 packages listed as affected, especially where client registration endpoints are reachable by untrusted networks. Red Hat marks 26.4.13 and 26.6.3 builds as unaffected in the provided data.
Exploitation context
The source bundle does not indicate known active exploitation, and KEV is false. Exploitation is described as unauthenticated and remote, but limited to inducing server errors and denial of service against affected client registration endpoints.
Researcher notes
Do not assume broader Keycloak versions are affected beyond the provided Red Hat package data. The vulnerability is characterized as CWE-125 and manifests through exception-driven HTTP 500 behavior. Evidence supports denial of service only, with no confidentiality or integrity impact stated.
Mitigation direction
- Apply the relevant Red Hat security advisories for affected Keycloak builds.
- Upgrade affected Red Hat Keycloak 26.4 or 26.6 packages to vendor-designated unaffected builds.
- Restrict untrusted access to client registration endpoints where operationally feasible.
- Monitor Red Hat CVE and errata pages for updated remediation guidance.
Validation and detection
- Inventory Red Hat build of Keycloak deployments and package versions.
- Check whether installed packages match affected versions in the CVE record.
- Confirm whether client registration endpoints are exposed to untrusted networks.
- Review application logs for repeated HTTP 500 errors around client registration requests.
- Verify updates align with RHSA-2026:25097, RHSA-2026:25098, RHSA-2026:30049, or RHSA-2026:30050.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-9803 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4redhatVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:25097CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25098CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30049CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30050CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9803CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2482465CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.