CVE-2026-4629 Red Hat CVE debrief

Who should care

Keycloak administrators, security teams, and users with manage-clients permissions should be aware of this vulnerability and take steps to mitigate it. Affected product deployments should be identified, and owners assigned for follow-up. Compensating controls may be necessary for exposed systems while remediation is scheduled and verified.

Technical summary

A flaw in Keycloak allows a highly privileged user with manage-clients permission to inject a hardcoded role mapper into any client, bypassing existing scope restrictions and injecting the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. The vulnerability is present in Keycloak deployments and can be exploited by users with manage-clients permissions. Administrators should review Keycloak configurations for potential security gaps and implement additional logging and auditing for client role mappings.

Defensive priority

Medium priority due to potential for privilege escalation

Recommended defensive actions

• Review and restrict manage-clients permissions
• Monitor for suspicious client configuration changes
• Implement additional logging and auditing for client role mappings
• Apply vendor patches or updates when available
• Consider compensating controls such as role-based access control
• Perform vulnerability scanning and risk assessment
• Review Keycloak configurations for potential security gaps

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected products. Vendor advisories and a bugzilla entry are also available. Keycloak administrators should verify the presence of manage-clients permissions and monitor for suspicious client configuration changes. Evidence limits suggest that further details may be required to fully understand the vulnerability's impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.