Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability
Published May 28, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.38%
Description
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
Affected products
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | affected |
|
- n/a
No data.
Red Hat build of Keycloak 26.6
rhbk/keycloak-operator-bundle:26.6.6-1
Fixed · RHSA-2026:56524
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9-operator:26.6-12
Fixed · RHSA-2026:56524
Red Hat build of Keycloak 26.6
rhbk/keycloak-rhel9:26.6-12
Fixed · RHSA-2026:56524
Red Hat build of Keycloak 26.6.6
rhbk-keycloak-rhel9/rhbk-keycloak-rhel9
Fixed · RHSA-2026:56523
Red Hat Build of Keycloak
rhbk/keycloak-rhel9
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-operator-bundle:26.6.6-1 | Fixed | RHSA-2026:56524 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9-operator:26.6-12 | Fixed | RHSA-2026:56524 |
| Red Hat build of Keycloak 26.6 | rhbk/keycloak-rhel9:26.6-12 | Fixed | RHSA-2026:56524 |
| Red Hat build of Keycloak 26.6.6 | rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 | Fixed | RHSA-2026:56523 |
| Red Hat Build of Keycloak | rhbk/keycloak-rhel9 | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Red Hat statement
A Moderate privilege escalation flaw exists in Keycloak where an authenticated administrator with `manage-clients` privileges can exploit a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. This allows them to escalate their privileges to `realm-admin` for all users within the realm, impacting the integrity of role-based access control.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (11)
- https://access.redhat.com/errata/RHSA-2026:56523 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56524 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-9796 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2482464 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32716 Advisory
- https://github.com/advisories/GHSA-pq65-77rc-7r8c Advisory
- https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934
- https://github.com/keycloak/keycloak/issues/49427
- https://github.com/keycloak/keycloak/pull/49624
- https://nvd.nist.gov/vuln/detail/CVE-2026-9796
- https://www.cve.org/CVERecord?id=CVE-2026-9796
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:56523 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/errata/RHSA-2026:56524 | vendor-advisoryx_refsource_REDHAT | |
| https://access.redhat.com/security/cve/CVE-2026-9796 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2482464 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32716 | Advisory | |
| https://github.com/advisories/GHSA-pq65-77rc-7r8c | Advisory | |
| https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934 | ||
| https://github.com/keycloak/keycloak/issues/49427 | ||
| https://github.com/keycloak/keycloak/pull/49624 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2026-9796 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-9796 |
Change history (0)
No recorded changes yet.