Red Hat Keycloak CVE-2026-37978

Exploitation requires an authenticated session to the Keycloak Admin REST API using credentials that hold at minimum the 'view-clients' role within the target realm; this is confirmed by the CVSS PR:H (High Privileges Required) designation. The 'evaluate-scopes' Admin API endpoint must be reachable over the network - if the Admin API is firewalled to trusted hosts only, remote exploitation is blocked. Exploitation does NOT require a realm administrator role or higher-privileged assignments. The vulnerability is NOT exploitable by unauthenticated users or by regular (non-admin) Keycloak end-users. Exploitation is limited to the confidentiality plane (no write access, no service disruption) and is scoped to the realm(s) the compromised admin account has access to. There is no dependency on a specific Keycloak configuration toggle or non-default feature - any deployment where 'view-clients' role assignments exist and the Admin API is network-accessible meets the exploitation conditions.

The CVSS base score of 4.9 (Medium) reflects a tension between the high confidentiality impact (C:H) and the high privilege prerequisite (PR:H). In practice, exploitation requires a valid Keycloak admin credential with the 'view-clients' role, which substantially limits the exposed population to insider threats, account compromise scenarios, or over-provisioned service accounts. The unchanged scope (S:U) confirms that the attacker cannot pivot to broader system compromise through this vulnerability alone. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, both of which reduce urgency for organizations without high-privilege account exposure. However, the PII leakage consequence is material for GDPR and compliance-sensitive deployments - the ability to enumerate realm-wide user identities and their authorization grants using a low-privilege role is a meaningful privilege escalation of information access. The attack complexity is low (AC:L), meaning once the prerequisite credential is obtained, exploitation requires no special knowledge or timing. Organizations with many delegated admins or externally accessible Admin API endpoints should treat this as a higher operational priority than the raw CVSS score implies.

An insider threat actor - or an attacker who has compromised a service account or low-privilege admin credential - authenticates to Keycloak's Admin API using credentials that carry the 'view-clients' role. The attacker then iterates the evaluate-scopes endpoint with sequentially or randomly chosen userId values, harvesting user identities, email addresses, claims, and authorization grants for users across the entire realm without any additional escalation. No public proof-of-concept code has been identified at time of analysis, but the attack path requires only standard HTTP API calls and knowledge of the endpoint.