Keycloak Admin REST API client cache flaw
A per-request in-memory cache in the Keycloak Admin REST API resolves clients by client_id incorrectly, potentially allowing unintended client resolution. Red Hat rates this CVSS 5.5 medium.
- Vendor
- Red Hat
- Product
- Keycloak
- CVSS
- 5.5
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-94215 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-94215 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored November 7, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-94215 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Admin REST API in Keycloak uses a per-request in-memory cache to resolve clients by client_id. A flaw in that resolution logic can lead to unintended client resolution. Red Hat did not fully disclose the scope or exploitation conditions in the published advisory.
Red Hat rates this CVSS 5.5 (medium). No active exploitation reported. Patched versions are listed in the Red Hat advisory.
Other Red Hat CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-94218 Keycloak session enforcement bypass on policy upgradewrite-up | [ LOW ] | 3.1 | 0.4% | — |
| CVE-2026-94217 Keycloak UMA token endpoint resource ownership confusionwrite-up | [ LOW ] | 3.5 | 0.3% | — |
| CVE-2026-94213 Keycloak authorization policy evaluation exposes permissionswrite-up | [ MEDIUM ] | 4.9 | 0.4% | — |
| CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability | [ MEDIUM ] | 6.9 | 5.0% | |
| CVE-2015-3246 Red Hat Libuser Race Condition Vulnerability | [ HIGH ] | 7.2 | 8.5% | |
| CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | [ CRITICAL ] | 9.8 | 74.2% | |
| CVE-2021-3560 Red Hat Polkit Incorrect Authorization Vulnerability | [ HIGH ] | 7.8 | 21.8% | |
| CVE-2021-4034 Red Hat Polkit Out-of-Bounds Read and Write Vulnerabilityransomware use | [ HIGH ] | 7.8 | 94.9% |
