CVE-2026-3190: 
Java vulnerability analysis and mitigation

CVE-2026-3190 is an information disclosure vulnerability in Keycloak's User-Managed Access (UMA) 2.0 Protection API, where the permission ticket endpoint fails to enforce the uma_protection role check. This allows any authenticated user holding a valid token issued for a resource server client — even without the uma_protection role — to enumerate all permission tickets in the system. The flaw was reported on February 25, 2026, and publicly disclosed on March 26, 2026. It affects Red Hat build of Keycloak (all versions prior to the patched releases). It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-280 (Improper Handling of Insufficient Permissions or Privileges), with an estimated secondary classification of CWE-862 (Missing Authorization). The UMA 2.0 Protection API endpoint responsible for listing permission tickets does not verify whether the requesting user's token includes the uma_protection role before returning results. An attacker only needs a valid, authenticated token scoped to any resource server client — no elevated privileges are required — to send a GET request to the permission tickets endpoint and receive a full enumeration of all tickets in the system. No public proof-of-concept code has been identified (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in partial information disclosure: an attacker can enumerate all permission tickets across the Keycloak system, potentially revealing sensitive authorization metadata such as resource ownership, granted permissions, and access relationships between users and resources. There is no impact on integrity or availability. While the vulnerability does not directly enable account takeover or lateral movement, the exposed permission ticket data could assist an attacker in mapping the authorization landscape of the system for further targeted attacks (Red Hat CVE, Red Hat Bugzilla).

1. Obtain a valid token: Authenticate as any user against a Keycloak realm that has a resource server client configured, obtaining a bearer token — the uma_protection role is not required.
2. Identify the UMA 2.0 Protection API endpoint: Locate the permission tickets endpoint, typically at {keycloak-base-url}/realms/{realm}/authz/protection/permission/ticket.
3. Send an enumeration request: Issue an HTTP GET request to the permission tickets endpoint with the bearer token in the Authorization header (e.g., Authorization: Bearer <token>).
4. Collect disclosed data: The API returns all permission tickets in the system without enforcing the uma_protection role check, exposing resource ownership, granted permissions, and user-resource relationships across the realm (Red Hat Bugzilla, Red Hat CVE).

• Network: Unusual or repeated HTTP GET requests to /realms/{realm}/authz/protection/permission/ticket from users or service accounts that do not hold the uma_protection role.
• Logs: Keycloak access logs showing successful 200 responses to the UMA permission ticket listing endpoint from tokens not associated with resource server administrators; high-frequency enumeration patterns from a single token or IP address.
• Behavioral: Authenticated sessions from low-privilege accounts querying the UMA Protection API endpoints, particularly outside of normal application workflows.

Red Hat has released patches addressing this vulnerability in Red Hat build of Keycloak 26.4.11, available via security advisories RHSA-2026:6477 (standalone packages) and RHSA-2026:6478 (OpenShift container images), both issued on April 2, 2026. The upstream Keycloak project also addressed this in version 26.5.6. Organizations should apply the available patches immediately. As interim mitigations, administrators should implement network-level access restrictions to the Keycloak UMA 2.0 Protection API endpoints, review and audit token issuance policies for resource server clients, and monitor permission ticket access logs for unauthorized enumeration attempts (RHSA-2026:6477, RHSA-2026:6478, Red Hat CVE).