CVE-2026-94215 Red Hat CVE debrief

Who should care

Defenders managing Keycloak deployments, especially those with multiple realms and administrators with limited privileges, should assess exposure and prioritize verification. They should review compensating controls for exposed systems while remediation is scheduled and verified. Defenders should also track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Defenders should prioritize verifying exposure in Keycloak deployments, especially those with multiple realms and administrators with limited privileges, due to the potential for exposure of client credentials or redirection of administrative login attempts.

• Potential exposure of client credentials
• Possible redirection of administrative login attempts to malicious sites
• Need for verification of Keycloak deployments and administrator privileges
• Potential impact on sensitive client configurations in the master realm

Technical summary

The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites. The flaw is in the Admin REST API of Keycloak, an open-source identity and access management solution.

Defensive priority

Defenders should prioritize verifying exposure in Keycloak deployments, especially those with multiple realms and administrators with limited privileges, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify Keycloak deployments for exposure to this flaw
• Assess the need for compensating controls or monitoring
• Review administrator privileges and limit them if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in Keycloak's Admin REST API, including its CVSS score and vector. The issue is caused by the API's use of a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.