VulnerabilityModified

CVE-2026-4629

A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client.

MEDIUM 6.5EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.49% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-266
Affected: redhat/build of keycloak
Source: secalert@redhat.com

References

https://access.redhat.com/errata/RHSA-2026:50846
https://access.redhat.com/errata/RHSA-2026:50847
https://access.redhat.com/security/cve/CVE-2026-4629Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2450244Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.