Analyst readout for executives and security teams
Plain-English summary
CVE-2026-9803 is a Keycloak denial-of-service flaw. An unauthenticated remote attacker can trigger server errors by sending malformed authorization data to client registration endpoints. The business impact is service disruption for affected Keycloak deployments, not data theft or privilege escalation based on the provided sources.
Executive priority
Treat as a near-term availability risk for Keycloak-backed authentication services. Prioritize exposed or business-critical identity systems first. This is not presented as a critical breach risk, but disruption to identity services can affect many dependent applications.
Technical view
Red Hat describes a flaw in Keycloak ClientRegistrationAuth. A malformed Authorization Bearer header in a POST request to any client registration endpoint can cause an ArrayIndexOutOfBoundsException and HTTP 500 responses. CVSS 3.1 is 5.3, network exploitable, low complexity, no privileges, no user interaction, with low availability impact.
Likely exposure
Exposure is most relevant for Red Hat build of Keycloak 26.6 deployments with reachable client registration endpoints, especially internet-facing identity services. The bundle lists affected Red Hat package streams and indicates Red Hat build of Keycloak 26.6.3 as unaffected, but exact fixed package details should be verified in Red Hat advisories.
Exploitation context
The source bundle does not indicate active exploitation, and the CVE is not marked KEV. Exploitation is described as remote and unauthenticated, but limited to causing availability impact through server errors. No evidence provided supports data compromise or code execution.
Researcher notes
Evidence comes from Red Hat and CVE records. The vulnerability is described as malformed authorization header handling in ClientRegistrationAuth leading to an exception. Affected Red Hat build of Keycloak 26.6 packages are listed, but remediation should be tied directly to the Red Hat errata because fixed build details are not fully enumerated in the bundle.
Mitigation direction
- Apply updates or guidance from RHSA-2026:25097 and RHSA-2026:25098.
- Check Red Hat’s CVE page for exact affected and fixed package status.
- Reduce unnecessary exposure of client registration endpoints according to vendor guidance.
- Monitor Keycloak availability until remediation is confirmed.
Validation and detection
- Inventory Red Hat build of Keycloak 26.6 deployments and listed packages.
- Compare installed package versions with Red Hat CVE and RHSA records.
- Confirm applicable RHSA updates are installed in each environment.
- Review Keycloak logs for unusual repeated HTTP 500 errors on client registration paths.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-9803 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L 3.9 1.4 redhat Vulnerability scoring details
Base CVSS 3.1 score
5.3 MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline redhat
Reported to Red Hat.
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline redhat
Made public.
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- RHSA-2026:25097 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:25098 CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9803 CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2482465 CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.