low advisory November 5, 2026

Keycloak: SAML XML processing denial of service (CVE-2026-107123)

An unauthenticated remote attacker can cause a denial of service in Keycloak by sending crafted SAML requests with malicious dateTime or duration values that trigger excessive CPU consumption.

Triage facts

Revision 1

Applicability: Keycloak
Evidence: Unknown
Severity: Low
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 5, 18:22 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

A vulnerability in the SAML XML processing component of Keycloak allows an unauthenticated remote attacker to trigger a denial of service (DoS) condition. The vulnerability arises from improper validation of XML dateTime or duration strings. When a specially crafted SAML request containing excessively long values is processed, the XML parser consumes high levels of CPU, potentially leading to service unavailability for all users.

Impact

Successful exploitation results in high CPU utilization and a denial of service, preventing legitimate users from accessing authentication services provided by the affected Keycloak instance.

Recommendation

Identify all internet-facing or SAML-enabled Keycloak instances within the environment.
Monitor for available patches from Red Hat to address CVE-2026-107123.
Implement rate limiting and request size restrictions for endpoints handling SAML authentication requests.
Review web application firewall logs for high-frequency or anomalous XML/SAML requests.

Immediate actions

Identify all instances of Keycloak in the production environment

IT Operations 24h

Threat Hunt

Identify abnormal spikes in CPU usage associated with SAML XML parsing activity

T1499.001 high medium confidence hunt now

Data: Keycloak server CPU metrics, Web server logs detailing request volume and source IP

Mitigations

Apply security patches for Keycloak as released by Red Hat

immediate IT Operations

CVE-2026-107123