No exploitation reported

CVE-2026-3047

No exploitation reported by the sources we read.

Published2026-03-05

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

Timeline

dates in UTC

2026-03-0519:16CVE publishedNVD

Versions per branch

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

keycloakBitnamifrom 26.2.0 · fixed in 26.2.1
org.keycloak:keycloak-broker-samlMavenall versions · no fixed version listed

Vendor advisories

CVE-2026-3047 Red Hat Product Security20 products fixed
org.keycloak.broker.saml: Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login
RHSA-2026:3948 Red Hat Product Security9 products fixed
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Images Update
RHSA-2026:3947 Red Hat Product Security1 product fixed
Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Update
RHSA-2026:3925 Red Hat Product Security9 products fixed
Red Hat Security Advisory: Red Hat build of Keycloak 26.2.14 Images Update
RHSA-2026:3926 Red Hat Product Security1 product fixed
Red Hat Security Advisory: Red Hat build of Keycloak 26.2.14 Update

Full record on NVD

Fix

Vendor fix Red Hat Product Security RHSA-2026:3948 · 9 productsBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Workaround from the vendor Red Hat Product Security RHSA-2026:3948 · 9 productsTo mitigate this issue, ensure that any SAML client intended to be disabled is not configured as an IdP-initiated broker landing target within Keycloak. Review your Keycloak realm configurations to identify and remove any such associations for disabled clients.

Detection

Nuclei template: none so far
Exploit-DB: no entry
Proof-of-concept repositories: none listed

Sources

NVDCVE record2026-03-26
FIRST EPSSEPSS score0.9 %2026-10-22
OSVaffected packages—

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-03-05
Last Modified: 2026-03-26

Frequently asked questions

What is CVE-2026-3047?

Is CVE-2026-3047 actively exploited?

Active exploitation of CVE-2026-3047 has not been confirmed. Its EPSS score was 0.9% on 2026-10-22, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-3047?

CVE-2026-3047 has a CVSS v3 base score of 8.8 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Running keycloak? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, October 2026 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database