EUVD-2026-32716
GHSA-pq65-77rc-7r8c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak allows an authenticated administrator holding the manage-clients role to exploit a Time-of-check to time-of-use (TOCTOU) race condition in name-based admin role checks, elevating their privileges to realm-admin for all users within the realm. The resulting composite role relationship is persistent - it survives both manual revocation of the attacker's original permissions and system reboots, making remediation non-trivial post-exploitation. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
Keycloak (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*) implements role-based access control through composite roles and fine-grained admin permissions. The name-based admin role check is a security gate that evaluates whether a caller has authority over a given role name. CWE-367 (Time-of-Check Time-of-Use) describes a class of race condition where the security-relevant state evaluated during the check differs from the state present during the subsequent use. In this case, the window between when Keycloak checks the admin's permissions and when it acts on the role assignment can be exploited to slip in an unauthorized realm-admin role binding. The persistence mechanism - composite role relationships that survive permission revocation and reboots - suggests the escalated privilege is stored at the realm data layer, not derived at runtime, making it immune to session invalidation or typical administrative remediation paths.
RemediationAI
No specific patched version was confirmed from the available input data. The Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-9796 and Bugzilla ticket https://bugzilla.redhat.com/show_bug.cgi?id=2482464 should be monitored for patch releases - apply any vendor-released update as the primary remediation. As an interim compensating control, revoke the manage-clients role from all non-essential administrators and enforce strict least-privilege assignment; this eliminates the attack surface for most threat actors. Audit current realm-admin composite role assignments to detect if any accounts have already been escalated - note that revocation alone will not undo a successful exploit, so affected realms may require manual removal of the persistent composite role binding at the data layer. Deployers should also consider enabling Keycloak admin audit logging and alerting on unexpected composite role changes as a detection mechanism.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Same technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today