CVE-2026-109081
Last modified
CVE-2026-109081 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. EPSS estimates a 0.36% chance of exploitation in the next 30 days.
Description
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.6 | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-109081?
How severe is CVE-2026-109081?
How do I fix CVE-2026-109081?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-10904Inappropriate implementation in V8 in Google Chrome prior to…8.8
- CVE-2026-10905Use after free in Network in Google Chrome prior to 149.0.78…8.3
- CVE-2026-10906Use after free in WebAuthentication in Google Chrome prior t…7.5
- CVE-2026-10907Out of bounds write in ANGLE in Google Chrome prior to 149.0…8.8
- CVE-2026-10908Use after free in FullScreen in Google Chrome on Windows pri…8.3
- CVE-2026-109080SQL injection in the bulk license plate search of the Flock …6.5
- CVE-2026-109082A flaw was found in the Client-Initiated Backchannel Authent…6.8
- CVE-2026-109083Improper isolation or compartmentalization vulnerability in …9.8
- CVE-2026-109088A malicious X server could send malformed RECORD EnableCont…6.5
- CVE-2026-109089A buffer overflow when handling DEVICE_RESOLUTION in libXi b…7.5
- CVE-2026-10909Use after free in Dawn in Google Chrome prior to 149.0.7827.…8.3
- CVE-2026-109090A malicious X server could cause a heap overflow by injectin…7.5
Are you affected by CVE-2026-109081?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST