Keycloak: Race condition in login-failure storage with MySQL/MariaDB
Summary
A race condition in the login-failure storage of Keycloak can lock a user's database record when many failed logins for the same account occur at the same time. This affects only multi-node deployments that use MySQL or MariaDB. An attacker can block legitimate logins for targeted accounts and may reduce the accuracy of the brute-force protection, which can allow more password guesses. Exploitation requires network access and a high-complexity race condition, but no privileges or user interaction.
Affected
- Keycloak keycloak-services 26.8.0 to 26.8.1 (per CVE record)
- Red Hat build of Keycloak and Red Hat Single Sign-On 7: listed as affected by the CNA, versions not confirmed
- Older branches: Unknown.
Fixed in
- Keycloak 26.8.2 (upstream release listed as security fix)
- Red Hat build of Keycloak: Unknown. Check the Red Hat CVE page and bug report.
Workaround
- No vendor-published workaround. Mitigation is either not available or not suitable according to Red Hat.
- Interim: monitor logs for lockouts of user accounts and bursts of failed logins against single accounts, and confirm that brute-force protection is enabled.
Exploitation
- No evidence of exploitation in the wild found in the research.
- No public proof-of-concept or exploit code found.
- VulDB rates the issue as critical, but this is an automated estimate that conflicts with the CNA's medium score (CVSS 4.8).
Our recommendation
- Check whether Keycloak runs as a multi-node cluster on MySQL or MariaDB. If so, prioritise this issue.
- Update to Keycloak 26.8.2 or a fixed Red Hat build; confirm the fixed version with your vendor.
- Monitor for account lockouts and repeated failed logins against single accounts.
- Otherwise, apply the update as part of routine maintenance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-112201 www.cve.org
- Red Hat CVE page CVE-2026-112201 access.redhat.com
- Red Hat Bugzilla 2555463 bugzilla.redhat.com
- Keycloak upstream issue 54687 github.com
- Keycloak 26.8.2 release github.com
- Keycloak security advisory GHSA-gc7q-jgjv-vjr2 github.com
- VulDB entry 435781 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:44.
Original description (NVD)
A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.