EUVD-2026-45224
GHSA-78mv-phq4-25fv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
API is network-accessible but requires delegated admin credentials (PR:H); impact is role integrity corruption only, with no confidentiality or system availability loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
AnalysisAI
Unauthorized role removal in Keycloak's admin REST API allows a delegated administrator to strip privileged child roles from composite roles they are not authorized to manage, corrupting the role hierarchy and revoking access for users and administrators who depend on those composite roles. Affected products span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, in multi-tenant enterprise deployments where delegated administration is common, the integrity impact to IAM role structures is operationally significant.
Technical ContextAI
Keycloak implements a composite role model in which a single role can aggregate multiple child roles, enabling flexible permission bundling across realms and clients. The admin REST API exposes endpoints for adding and removing child roles from composite roles, scoped to delegated administrators who manage specific realms or clients. The flaw arises because the server-side authorization check that should verify whether the calling delegated admin has permission to manage the target privileged role is absent during the removal operation. This aligns with CWE-862 (Missing Authorization) - the system permits an action (child role removal) without confirming the caller's authorization scope covers the target resource. CPE data confirms affected products as cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_data_grid_8, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack. Exact version ranges are not derivable from the wildcard CPE fields provided.
RemediationAI
Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-16106 for confirmed patched versions across all affected product lines, as no exact fixed version number is derivable from the provided input data. The upstream Red Hat Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2501739 should be monitored for patch status updates. As an interim compensating control, reduce the number of active delegated administrator accounts to the minimum necessary, and restrict which delegated admins are granted scope over composite role management - this limits the pool of accounts that could be compromised or abused. Enable and review Keycloak admin event audit logs (Admin Events in the realm settings) to detect unauthorized composite role modifications; note that this is a detective rather than preventive control and does not block exploitation. Restricting network access to the Keycloak admin REST API to trusted management networks reduces exposure without functional trade-off in most enterprise deployments.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today