EUVD-2026-32716
GHSA-pq65-77rc-7r8c
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
AnalysisAI
Privilege escalation in Red Hat Build of Keycloak allows an authenticated administrator holding the manage-clients role to exploit a Time-of-check to time-of-use (TOCTOU) race condition in name-based admin role checks, elevating their privileges to realm-admin for all users within the realm. The resulting composite role relationship is persistent - it survives both manual revocation of the attacker's original permissions and system reboots, making remediation non-trivial post-exploitation. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
Keycloak (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*) implements role-based access control through composite roles and fine-grained admin permissions. The name-based admin role check is a security gate that evaluates whether a caller has authority over a given role name. CWE-367 (Time-of-Check Time-of-Use) describes a class of race condition where the security-relevant state evaluated during the check differs from the state present during the subsequent use. In this case, the window between when Keycloak checks the admin's permissions and when it acts on the role assignment can be exploited to slip in an unauthorized realm-admin role binding. The persistence mechanism - composite role relationships that survive permission revocation and reboots - suggests the escalated privilege is stored at the realm data layer, not derived at runtime, making it immune to session invalidation or typical administrative remediation paths.
RemediationAI
No specific patched version was confirmed from the available input data. The Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-9796 and Bugzilla ticket https://bugzilla.redhat.com/show_bug.cgi?id=2482464 should be monitored for patch releases - apply any vendor-released update as the primary remediation. As an interim compensating control, revoke the manage-clients role from all non-essential administrators and enforce strict least-privilege assignment; this eliminates the attack surface for most threat actors. Audit current realm-admin composite role assignments to detect if any accounts have already been escalated - note that revocation alone will not undo a successful exploit, so affected realms may require manual removal of the persistent composite role binding at the data layer. Deployers should also consider enabling Keycloak admin audit logging and alerting on unexpected composite role changes as a detection mechanism.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today