CVE-2026-3911
Low · 2.7CVSS
2.7
EPSS
0.4%
Published
Mar 11, 2026
CISA due date
—
The record
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | keycloak-26.5 | 0 | 26.5.6-r0 |
| Chainguard | keycloak-26.5-iamguarded-compat | 0 | 26.5.6-r0 |
| Chainguard | keycloak-fips-26.5 | 0 | 26.5.6-r0 |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | 0 | 26.5.6-r0 |
| Wolfi | keycloak-26.5 | 0 | 26.5.6-r0 |
| Wolfi | keycloak-26.5-iamguarded-compat | 0 | 26.5.6-r0 |
Related vulnerabilities
- CVE-2026-33871 Netty is an asynchronous, event-driven network application framework. Also affects keycloak-26.5
- CVE-2026-33870 Netty is an asynchronous, event-driven network application framework. Also affects keycloak-26.5
- CVE-2026-3429 A flaw was identified in the Account REST API of Keycloak that allows a user… Also affects keycloak-26.5
- CVE-2026-1190 A flaw was found in Keycloak's SAML brokering functionality. Also affects keycloak-26.5
- CVE-2025-14559 A flaw was found in the keycloak-services component of Keycloak. Also affects keycloak-26.5
- CVE-2025-66560 Quarkus is a Cloud Native, (Linux) Container First framework for writing Java… Also affects keycloak-26.5