Introduction
A single unauthenticated client that can reach Keycloak's SAML SOAP endpoints can send oversized XML messages that drive the server out of memory and crash it, producing a denial of service for all users of that identity provider. Because Keycloak sits in front of every application that delegates login to it, an availability flaw in this layer affects authentication broadly rather than one application at a time.
Keycloak is an open-source identity and access management project that provides centralized authentication and authorization for applications and APIs. CNCF accepted it on April 10, 2023 at the Incubating maturity level, and the CNCF announcement names production users including Accenture, CERN, Cisco, Hitachi, and Okta. Red Hat ships commercial distributions built on it, Red Hat Build of Keycloak and the older Red Hat Single Sign On 7, so this SAML code path is relevant to both community and enterprise deployments.
Red Hat, acting as the CNA, scores CVE-2026-82965 at CVSS 3.1: 7.5 (High) and rates it Important in its own severity scheme. NVD published the record on November 5, 2026. The impact is limited to availability. There is no authentication bypass and no data exposure.
Technical information
Root cause
Red Hat places the flaw in Keycloak's SAML implementation, specifically the SAML Artifact Resolution and ECP SOAP endpoints. The vendor's stated root cause is insufficient validation of XML payload size and element count: incoming SOAP XML requests are processed without adequate bounds on how large or how complex they can be. The weakness is classified as CWE-400, Uncontrolled Resource Consumption.
The upstream Keycloak issue (#54709) names the Artifact Resolution path explicitly:
/realms/{realm}/protocol/saml/resolve
The reviewed sources do not provide an exact path for the ECP endpoint.
Attack flow
Based on the vendor description, the documented sequence is:
- An unauthenticated remote attacker sends a request to a SAML SOAP endpoint (Artifact Resolution or ECP). No account and no victim interaction are required.
- The request carries a specially crafted, large XML message.
- Keycloak processes the XML without sufficient size or complexity limits, and memory consumption grows accordingly.
- The application runs out of memory and the Keycloak process crashes.
- Authentication becomes unavailable for all users until the service is restored.
CVSS vector
The CNA vector published by Red Hat, displayed on NVD while NIST's own assessment is pending enrichment:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In practical terms, that means network reachable, low attack complexity, no privileges, no user interaction, unchanged scope, and only availability impact (rated High). The score supports prioritizing remediation of an availability exposure. It does not by itself indicate exploitation in the wild.
What is not publicly established
The available descriptions establish inadequate resource bounding, not the internals of the parser. The upstream issue contains no substantive description, reproduction steps, parser function names, linked patch, or regression test details. As a result, the exact payload structure, minimum request size, required request frequency, and memory threshold at which the process fails are not documented in public sources. We have not filled those gaps with speculation.
Disclosure timeline
- August 31, 2026: Red Hat Bugzilla records the initial report (bug 2526302).
- November 5, 2026: Upstream issue #54709 is opened and closed as completed, Keycloak 26.8.2 is released listing the CVE under security fixes, and NVD publishes the record.
Exploitation status
In the reviewed primary records (Red Hat Bugzilla, NVD, and the upstream issue) we found no exploitation campaign, threat actor attribution, victim reporting, or public proof of concept. VulDB lists KEV status as no and activity as very low, but those are secondary database fields, and the CISA KEV page we reviewed showed only a paginated sample. The defensible position is that active exploitation is unconfirmed, not that the flaw is unexploited.
Affected systems and versions
The affected component is the SAML Artifact Resolution and ECP SOAP request handling in Keycloak (the keycloak services layer). The evidence differs by distribution:
- Community Keycloak 26.8.2: The official release notes list CVE-2026-82965 (issue 54709) under resolved security fixes. This is the strongest available fix evidence.
- Community 26.4 and 26.6 branches: The upstream issue carries release labels 26.4.17 and 26.6.8. Treat these as associated backport versions. The reviewed issue alone does not confirm that those artifacts have been released.
- Earlier community versions: A precise lower bound of the affected range is not published in the reviewed sources.
- Red Hat Build of Keycloak: The CVE record lists this product with the default wording "All versions are affected" and no numeric fixed version.
- Red Hat Single Sign On 7: Same default affected status, with no numeric fixed version listed.
A community release number is not automatically equivalent to a Red Hat product erratum. Red Hat's lifecycle policy describes security fixes being delivered through its own product updates, so commercial customers should obtain product-specific status from Red Hat's advisory and support channels.
Remediation notes
- Community deployments: Move to 26.8.2 and consult the migration guide before upgrading.
- Upgrade safeguards: The Keycloak upgrading guide instructs administrators to back up the database first, and to shut down nodes running the old version when database migration is required. Schema migration happens automatically on first startup of the new version, the migrated schema is not compatible with the old server, and rollback means restoring the old installation plus the database backup. These are general upgrade safeguards, not a claim that this specific fix changes the schema.
- Workarounds: Red Hat states that no mitigation meets its criteria for ease of deployment, broad applicability, or stability. VulDB separately suggests a WAF or reverse proxy that rejects requests above a byte threshold before they reach Keycloak. That is secondary advice. No validated threshold has been published, and size filtering is not shown to cover XML complexity, so it should not be treated as equivalent to the fix.
Vendor security history
Keycloak publishes a security policy calling for private vulnerability reporting, with acknowledgement within 7 business days, and a Security Taskforce charter assigning triage, impact evaluation, resolution, testing, and release coordination. An independent CNCF security assessment completed in October 2020 against Keycloak v10.0.2 recommended threat modeling, better organized documentation, and clearer guidance on security-sensitive configuration. Given its age and version scope, it does not describe the current release.
Two recent SAML availability issues are worth comparing, mainly to avoid conflating them with this one:
- CVE-2026-7307: Crafted SAML XML caused high CPU use and worker thread starvation, and the advisory lists 26.6.2 as patched. That fix is not evidence that CVE-2026-82965 is fixed.
- CVE-2026-2575: Highly compressed SAMLRequest data with missing limits during DEFLATE decompression could cause an OutOfMemoryError and process termination. The issue is completed with a merged fix, but the mechanism (decompression) differs from unbounded SOAP XML processing.
All three share an availability outcome but occur at different processing stages, so fix versions and technical explanations should not be transferred between them. The pattern does suggest that SAML input handling has been a recurring source of resource exhaustion issues in Keycloak.
References
- NVD entry for CVE-2026-82965
- CVE.org record for CVE-2026-82965
- Red Hat Customer Portal advisory for CVE-2026-82965
- Red Hat Bugzilla 2526302
- Keycloak GitHub issue 54709
- Keycloak 26.8.2 release on GitHub
- Keycloak 26.8.2 on newreleases.io
- Keycloak Upgrading Guide
- Red Hat Build of Keycloak product page
- Red Hat Build of Keycloak life cycle and support policies
- VulDB entry for CVE-2026-82965
- CISA Known Exploited Vulnerabilities Catalog
- GitHub Advisory for CVE-2026-7307
- Keycloak issue 46372 (CVE-2026-2575)
- Keycloak Security Policy
- Keycloak Security Charter
- CNCF TAG Security assessment of Keycloak
- Keycloak project page at CNCF
- Keycloak joins CNCF as an incubating project
- Keycloak 26.7.2 release announcement
