CVE-2026-4282 Red Hat CVE debrief

Who should care

Organizations using Keycloak for authentication and authorization should prioritize patching this vulnerability. Unauthenticated attackers can exploit this flaw to escalate privileges, potentially leading to unauthorized access to sensitive resources. Keycloak administrators should review their deployments and ensure they are running a patched version.

Technical summary

The SingleUseObjectProvider in Keycloak lacks proper type and namespace isolation, allowing unauthenticated attackers to forge authorization codes. This can lead to the creation of admin-capable access tokens, resulting in privilege escalation. The vulnerability has a CVSS score of 7.4 and is considered high severity. The attack vector is network-based, and the vulnerability can be exploited without requiring user interaction.

Defensive priority

High priority should be given to patching this vulnerability, as it allows for unauthenticated privilege escalation. Keycloak administrators should review their deployments and ensure they are running a patched version.

Recommended defensive actions

• Review Keycloak deployments and ensure they are running a patched version.
• Apply the latest security patches provided by Red Hat.
• Monitor for suspicious activity related to authorization codes and access tokens.
• Implement additional security measures, such as enhanced authentication and authorization controls.
• Consider compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent exploitation attempts.

Evidence notes

The vulnerability was published on April 2, 2026, and last modified on June 30, 2026. The CVSS score is 7.4, indicating a high severity. The vulnerability affects Keycloak and can be exploited by unauthenticated attackers to escalate privileges.

Official resources