A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending
    specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or
    Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker
    can determine the client's protocol type, leading to information disclosure. (CVE-2026-9794)

ID	Name	Product	Family	Type	Severity
464929	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464929	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
444295	SCA: security update for org.keycloak:keycloak-services (GHSA-fqjh-8322-vgrv)	Tenable Cloud Security	SCA Checks	Local	medium
444295	SCA: security update for org.keycloak:keycloak-services (GHSA-fqjh-8322-vgrv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-9794

medium

Tenable Plugins

medium

medium

medium

medium