EUVD-2026-40300
GHSA-m4j4-8chj-8g5f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Scope changed to S:C because privilege escalation to realm-admin crosses the manage-clients authorization boundary, affecting all realm components beyond the attacker's granted scope.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak allows an operator holding the manage-clients permission to inject a hardcoded role mapper into any client configuration, causing the realm-admin role to appear in subsequently issued tokens. This effectively grants the attacker full administrative control over the entire Keycloak realm, overriding scope restrictions that are intended to prevent exactly this delegation boundary crossing. No active exploitation has been confirmed (not listed in CISA KEV), no public proof-of-concept has been identified at time of analysis, and no EPSS data was available; however, the high-impact nature of achieving realm-admin privileges makes this a meaningful insider or delegated-admin threat.
Technical ContextAI
Keycloak is a widely deployed open-source Identity and Access Management platform commonly used for SSO, OAuth2, and OIDC token issuance in enterprise environments. Clients in Keycloak are application registrations that receive scoped JWT tokens; role mappers are protocol mapper configurations that control which roles are embedded into those tokens. The manage-clients permission is a delegated administrative privilege in Keycloak intended to allow a limited operator to administer client registrations without granting full realm-admin access - a common pattern in multi-tenant deployments. The root cause, classified as CWE-266 (Incorrect Privilege Assignment), is that the platform fails to enforce scope boundaries when a role mapper is injected with a hardcoded reference to the realm-admin composite role. A properly implemented permission model should prevent a manage-clients holder from escalating to roles above their own privilege tier. The affected product is identified by CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:* - all versions of the Red Hat distribution are indicated as affected.
RemediationAI
No vendor-released patch version has been independently confirmed from the available data. Monitor https://access.redhat.com/security/cve/CVE-2026-4629 for patch releases from Red Hat. In the interim, the most effective compensating control is to audit and restrict who holds the manage-clients permission across all realms - organizations practicing least privilege should ensure this role is held only by fully trusted administrators, narrowing the attack surface to the insider threat model. Where manage-clients must be delegated to lower-trust operators, consider implementing additional monitoring of protocol mapper configurations for unexpected role mapper entries referencing high-privilege roles such as realm-admin. Keycloak's built-in admin events log can be used to detect and alert on client-level mapper changes. There is no configuration setting to disable role mapper injection entirely without breaking legitimate use cases, so access restriction is the primary compensating control. Trade-off: restricting manage-clients delegation may reduce operational flexibility in multi-tenant deployments.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today