CVE-2026-12388: Keycloak IdP Mapper Privilege Escalation – Red Hat Security Advisory

Technical summary

The flaw exists in Keycloak's IdP mapper component, which translates user attributes and roles from external identity sources into Keycloak user models. The mapper fails to properly validate or restrict which roles can be assigned through the 'Hardcoded Role' mapper configuration. An administrator account with limited identity provider management permissions can exploit this to inject administrative roles into their own account or other accounts, bypassing role-based access control (RBAC) enforcement. The vulnerability is classified under CWE-266 (Improper Privilege Management), indicating a fundamental breakdown in permission verification during role assignment.

Business impact

Compromised Keycloak administrators can gain unrestricted control over the entire authentication realm, including the ability to modify other users, grant themselves additional permissions, alter security policies, and potentially access or modify sensitive identity data across all integrated applications. This transforms a limited administrative account into a full realm administrator, enabling attackers to conduct lateral movement, data theft, or service disruption across all systems relying on the Keycloak instance for authentication. Organizations with federated identity architectures face particularly high risk, as Keycloak often serves as a central trust anchor.

Affected systems

Red Hat build of Keycloak is confirmed affected. Any Keycloak instance where administrators have been granted limited permissions (such as manage-identity-providers but not full realm-admin rights) is vulnerable if those administrators have malicious intent or compromised credentials. The vulnerability applies across all deployment models: on-premises, containerized, and cloud-hosted.

Exploitability

Exploitation requires valid administrative credentials with at least limited identity provider management permissions. No public exploit code is known at this time, and the vulnerability does not appear on the KEV (Known Exploited Vulnerabilities) catalog, indicating no evidence of active exploitation in the wild as of the published date. However, the attack is straightforward to execute for anyone holding the required permissions: navigate to identity provider configuration, create or modify a hardcoded role mapper, and add administrative roles. The low complexity (AC:L) and high privilege requirement (PR:H) reflect that while execution is simple, the attacker must already be inside the administrative boundary.

Remediation

Apply security updates from Red Hat addressing CVE-2026-12388 in your Keycloak deployment. Verify the specific patched version against Red Hat's official advisory. In the interim, restrict identity provider management permissions to only highly trusted administrators and implement additional monitoring for role mapper creation and modification events. Review existing identity provider configurations for suspicious hardcoded role assignments, particularly those assigning realm-admin or other high-privilege roles.

Patch guidance

Consult Red Hat's official security advisory for CVE-2026-12388 to identify the patched version(s) for your Keycloak build. Apply updates in a test environment first to ensure compatibility with your federated authentication setup. Since Keycloak often serves as a critical authentication hub, coordinate patching with minimal service windows and test failover procedures. If you are running on Kubernetes or OpenShift, update your container images and redeploy pods after patching. Verify that identity provider mappings continue to function correctly post-patch.

Detection guidance

Monitor Keycloak logs for creation or modification of identity provider mappers, particularly 'Hardcoded Role' mappers that assign sensitive roles. Alert on any role mapper changes that include realm-admin, admin, or other high-privilege roles in the hardcoded assignments. Audit administrative user accounts for unexpected role escalations, especially changes occurring outside of normal administration windows. If available, enable detailed audit logging on identity provider configuration changes. Compare current mapper configurations against your baseline to identify unauthorized additions.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.5), this vulnerability warrants prompt attention because it directly enables privilege escalation within a critical authentication component. Keycloak typically acts as a centralized identity broker; compromise of its administrative controls undermines the security posture of every application depending on it. The requirement for existing administrative access limits the immediate risk to insider threats and lateral movement scenarios, but organizations should not delay patching. Prioritize instances where identity provider management is delegated to multiple administrators.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the combination of high-privilege requirement (PR:H), network-accessible attack vector (AV:N), and low attack complexity (AC:L), balanced against the confidentiality and integrity impact being high (C:H, I:H) while availability is not impacted (A:N). The severity reflects that while the vulnerability is easy to exploit, it requires pre-existing administrative credentials, which reduces exploitability in pure external attack scenarios. However, for organizations concerned with insider threats or credential compromise, the impact reaches the upper end of MEDIUM severity.

Frequently asked questions