PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-18201 Red Hat CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T10:16:40.620Z and has not been modified since then. Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations. The issue arises from insufficient permission checks when linking new identity providers to organizations. Defenders should verify affected Keycloak instances, review administrative API permissions, and monitor for unauthorized changes.

Vendor
Red Hat
Product
Red Hat Build of Keycloak
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-08-07
Advisory published
2026-07-29
Advisory updated
2026-08-07

Who should care

Administrators managing Keycloak instances, especially those with multiple organizations and identity providers configured, should review and restrict administrative API permissions to prevent unauthorized changes. Security teams and vulnerability management teams should also be aware of the potential impact and ensure proper mitigations are in place.

Technical summary

A flaw in Keycloak's administrative API allows an administrator with permission to manage identity providers to link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations, potentially bypassing intended access controls. The issue arises from insufficient permission checks when linking new identity providers to organizations. Defenders should verify affected Keycloak instances, review administrative API permissions, and monitor for unauthorized changes. The flaw has a CVSS score of 5.5 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive review recommended due to potential unauthorized administrator influence on user login to specific organizations.

Recommended defensive actions

  • Review and restrict administrative API permissions for managing identity providers and organizations.
  • Implement monitoring for unauthorized changes to identity provider configurations.
  • Verify vendor remediation and apply patches.
  • Conduct inventory checks for affected Keycloak instances.
  • Enforce compensating controls for sensitive organizations.

Evidence notes

Evidence from official vulnerability database and vendor advisory indicates a flaw in Keycloak's administrative API allowing unauthorized administrators to influence user login to specific organizations. The issue arises from insufficient permission checks when linking new identity providers to organizations. Defenders should verify affected Keycloak instances, review administrative API permissions, and monitor for unauthorized changes.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T10:16:40.620Z and has not been modified since then.