PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4629 Red Hat CVE debrief

A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client, allowing the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm. This vulnerability affects Keycloak deployments where manage-clients permissions are present, and administrators should verify the presence of such permissions and monitor for suspicious client configuration changes. Evidence limits suggest that further details may be required to fully understand the vulnerability's impact, and Keycloak administrators should take steps to mitigate this vulnerability.

Vendor
Red Hat
Product
Red Hat build of Keycloak 26.4
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-30
Original CVE updated
2026-08-05
Advisory published
2026-06-30
Advisory updated
2026-08-05

Who should care

Keycloak administrators, security teams, and users with manage-clients permissions should be aware of this vulnerability and take steps to mitigate it. Affected product deployments should be identified, and owners assigned for follow-up. Compensating controls may be necessary for exposed systems while remediation is scheduled and verified.

Technical summary

A flaw in Keycloak allows a highly privileged user with manage-clients permission to inject a hardcoded role mapper into any client, bypassing existing scope restrictions and injecting the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. The vulnerability is present in Keycloak deployments and can be exploited by users with manage-clients permissions. Administrators should review Keycloak configurations for potential security gaps and implement additional logging and auditing for client role mappings.

Defensive priority

Medium priority due to potential for privilege escalation

Recommended defensive actions

  • Review and restrict manage-clients permissions
  • Monitor for suspicious client configuration changes
  • Implement additional logging and auditing for client role mappings
  • Apply vendor patches or updates when available
  • Consider compensating controls such as role-based access control
  • Perform vulnerability scanning and risk assessment
  • Review Keycloak configurations for potential security gaps

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected products. Vendor advisories and a bugzilla entry are also available. Keycloak administrators should verify the presence of manage-clients permissions and monitor for suspicious client configuration changes. Evidence limits suggest that further details may be required to fully understand the vulnerability's impact.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-30T13:18:59.350Z and has not been modified since then.