Bug 2517354 (CVE-2026-74909)

Summary: CVE-2026-74909 keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-09   

Description OSIDB Bzimport 2026-08-17 10:51:56 UTC 
An incomplete fix for CVE-2026-15573 in Keycloak PathMatcher allows an authenticated attacker to bypass authorization policies. The original fix introduced URI normalization to strip matrix parameters and resolve dot segments, but this cleanup occurs before percent-decoding. Consequently, percent-encoded semicolons (percent-3B) and percent-encoded dot segments (percent-2Epercent-2E) bypass the normalization logic. When the Keycloak policy enforcer is used with a servlet container that decodes these characters during routing (such as Tomcat or WildFly), the enforcer matches the request against a permissive catch-all resource while the container routes the request to a restricted endpoint. This allows a low-privilege user to access protected resources that should be denied by the configured policy.