Keycloak authorization policy evaluation exposes permissions
A flaw in the Keycloak Authorization Services policy evaluation endpoint can surface permission information beyond what is intended. Red Hat rates this CVSS 4.9 medium.
- Vendor
- Red Hat
- Product
- Keycloak
- CVSS
- 4.9
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-94213 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-94213 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored November 7, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-94213 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Authorization Services component in Keycloak exposes a policy evaluation endpoint used by administrators to test authorization policies. A flaw in the endpoint can surface permission information beyond what is intended.
Red Hat rates this CVSS 4.9 (medium). No active exploitation reported. Patched versions are listed in the Red Hat advisory.
Other Red Hat CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-94218 Keycloak session enforcement bypass on policy upgradewrite-up | [ LOW ] | 3.1 | 0.4% | — |
| CVE-2026-94217 Keycloak UMA token endpoint resource ownership confusionwrite-up | [ LOW ] | 3.5 | 0.3% | — |
| CVE-2026-94215 Keycloak Admin REST API client cache flawwrite-up | [ MEDIUM ] | 5.5 | 0.4% | — |
| CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | [ MEDIUM ] | 6.9 | 5.0% | |
| CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability | [ HIGH ] | 7.2 | 8.5% | |
| CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | [ CRITICAL ] | 9.8 | 74.2% | |
| CVE-2021-3560 Red Hat Polkit Incorrect Authorization Vulnerability | [ HIGH ] | 7.8 | 21.8% | |
| CVE-2021-4034 Red Hat Polkit Out-of-Bounds Read and Write Vulnerabilityransomware use | [ HIGH ] | 7.8 | 94.9% |
