Red Hat Build Of Keycloak CVE-2026-4628

This vulnerability presents a low-to-moderate real-world risk despite its CVSS 4.3 score. The CVSS vector indicates relatively low severity due to the requirement for valid credentials (PR:L), network accessibility (AV:N), low attack complexity (AC:L), and limited impact scope (integrity only, no confidentiality or availability). The attack requires authentication, which significantly reduces the threat surface compared to unauthenticated exploits. The integrity impact (I:L) is limited, suggesting unauthorized modification affects only specific resource attributes rather than wholesale data destruction or compromise. No KEV (Known Exploited Vulnerability) status has been assigned, and no public proof-of-concept exists, indicating this is not actively exploited in the wild. Organizations should prioritize this vulnerability in moderate-risk systems where resource integrity is important but not critical, and in environments where user-managed access control policies are actively deployed. However, enterprises relying on Keycloak for high-assurance access control decisions or those operating in regulated environments should treat this as a higher priority due to its impact on authorization enforcement, even given the low CVSS score.

An authenticated user with valid credentials to a Keycloak realm exploits the incomplete access control validation on PUT requests to the resource_set endpoint. Despite the administrator setting allowRemoteResourceManagement=false to prevent remote resource modifications, the attacker sends a crafted PUT request with modified resource attributes (such as access policies, scopes, or ownership claims) to an endpoint like /auth/realms/{realm}/authz/protection/resource_set/{resource_id}. Due to the missing authorization enforcement on PUT operations, the endpoint accepts the request and modifies the protected resource definition without verifying the attacker has modification privileges, resulting in unauthorized changes to resource access policies. This could allow the attacker to escalate permissions, grant themselves access to restricted resources, or modify resource scope definitions to bypass intended access controls.