Red Hat Keycloak EUVD-2026-32716

Exploitation requires an authenticated user account with the manage-clients delegated admin role assigned within the target Keycloak realm - confirmed by CVSS PR:H. This role must have been explicitly granted, meaning the attack surface is limited to deployments where manage-clients is delegated to sub-administrators rather than reserved exclusively for top-level realm admins. The TOCTOU exploitation requires the attacker to successfully time a race condition against Keycloak's name-based role check, implying some degree of timing sensitivity, though CVSS AC:L suggests this is not a high-complexity barrier once attempted. Exploitation is limited by: the requirement for a pre-existing privileged account (PR:H), the race-condition timing window (may require repeated attempts), and the fact that AV:N/UI:N means no victim interaction or physical access is needed once the account is in hand. No special network position (e.g., same subnet, on-path) is required.

The CVSS base score of 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N reflects high confidentiality and integrity impact tempered significantly by the PR:H prerequisite - only an already-privileged administrator can trigger this. This is not a remote unauthenticated exploit. Real-world risk is moderate-to-high in multi-tenant or large enterprise Keycloak deployments where the manage-clients role is delegated to sub-administrators or less-trusted operators, as it provides a clear lateral escalation path to full realm control. EPSS data was not provided, and the CVE is not listed in CISA KEV, suggesting no confirmed widespread active exploitation. The most concerning signal is persistence: the attack survives both permission revocation and reboot, meaning standard incident response steps (revoke the account, restart the service) are insufficient to undo the compromise. There is no stated conflict between CVSS signals and the description - PR:H accurately reflects the manage-clients role requirement.

An attacker who legitimately holds the manage-clients delegated administrator role in a Keycloak realm - such as a developer or support staff with scoped admin access - crafts a timing-based attack against the name-based role check to assign themselves the realm-admin composite role during the TOCTOU window. Once the escalation is committed to the realm data store, the attacker gains full administrative control over all users, clients, and configurations within the realm. Even if the security team discovers the breach and revokes the original manage-clients role, the realm-admin composite binding persists, giving the attacker continued covert access. No public exploit code has been identified at time of analysis.