CVE-2026-18201 Red Hat CVE debrief

Who should care

Administrators managing Keycloak instances, especially those with multiple organizations and identity providers configured, should review and restrict administrative API permissions to prevent unauthorized changes. Security teams and vulnerability management teams should also be aware of the potential impact and ensure proper mitigations are in place.

Technical summary

A flaw in Keycloak's administrative API allows an administrator with permission to manage identity providers to link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations, potentially bypassing intended access controls. The issue arises from insufficient permission checks when linking new identity providers to organizations. Defenders should verify affected Keycloak instances, review administrative API permissions, and monitor for unauthorized changes. The flaw has a CVSS score of 5.5 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive review recommended due to potential unauthorized administrator influence on user login to specific organizations.

Recommended defensive actions

• Review and restrict administrative API permissions for managing identity providers and organizations.
• Implement monitoring for unauthorized changes to identity provider configurations.
• Verify vendor remediation and apply patches.
• Conduct inventory checks for affected Keycloak instances.
• Enforce compensating controls for sensitive organizations.

Evidence notes

Evidence from official vulnerability database and vendor advisory indicates a flaw in Keycloak's administrative API allowing unauthorized administrators to influence user login to specific organizations. The issue arises from insufficient permission checks when linking new identity providers to organizations. Defenders should verify affected Keycloak instances, review administrative API permissions, and monitor for unauthorized changes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.