CVE-2026-14614: Keycloak Admin Scope Injection via FGAP v2 Bypass

Technical summary

CVE-2026-14614 is an authorization bypass in Keycloak's ClientResource admin component when FGAP v2 is enabled. The vulnerability allows a delegated administrator with limited scope to attach or detach hidden client scopes despite lacking explicit permissions to view or manage them. The flaw stems from insufficient validation of scope visibility and administrative rights during scope manipulation operations, enabling privilege escalation through token injection. Affected versions use the Red Hat build of Keycloak; patch status should be verified against the vendor advisory.

Business impact

This vulnerability creates a privilege escalation path for internal administrators. A delegated admin—intended to manage only specific clients—can silently modify token permissions, injecting claims or scopes that trick downstream applications into granting elevated access. In multi-tenant or shared Keycloak deployments, this undermines the security model that FGAP v2 was designed to enforce, risking unauthorized data access, compliance violations, and lateral privilege escalation within the identity ecosystem.

Affected systems

Red Hat build of Keycloak is confirmed affected. Organizations running Keycloak with Fine-Grained Admin Permissions v2 enabled are at risk. The vulnerability applies specifically to delegated administrator accounts; full admin accounts with unrestricted permissions are not the attack vector. Impact scope is limited to Keycloak instances where FGAP v2 is actively in use.

Exploitability

Exploitation requires valid administrative credentials with delegated scope (the attacker must already be a trusted admin account). No network authentication bypass is involved, and user interaction is not required. However, the attack is straightforward once credentials are compromised or a malicious insider acts: attaching hidden scopes leaves no obvious audit trail and occurs within normal admin workflows. CVSS 5.4 (Medium) reflects the need for existing admin access, balanced against the confidentiality and integrity impact of scope injection.

Remediation

Apply security patches from Red Hat for the affected build of Keycloak as soon as they become available. Verify patch version numbers and applicability against the vendor advisory. Organizations should audit existing delegated administrators' scope assignments and monitor for suspicious scope modifications in admin logs. Consider implementing additional logging or alerting on hidden scope changes until patches are deployed.

Patch guidance

Monitor Red Hat's security advisories and Keycloak release notes for patches addressing CVE-2026-14614. Test patches in a non-production FGAP v2 environment before rollout to confirm no regressions in admin workflows. After patching, review recent scope audit logs to detect any unauthorized changes made prior to remediation. Verify against the vendor advisory for exact version numbers and deployment instructions.

Detection guidance

Review Keycloak admin audit logs for ClientResource scope modification events, particularly those involving hidden or system-managed scopes. Flag cases where a delegated administrator modified scopes outside their stated authorization scope. Monitor for unusual claims or scopes appearing in issued tokens that do not match client registrations or user assignments. If Keycloak audit logging is enabled, look for mismatch between declared admin permissions and actual scope changes.

Why prioritize this

Although this vulnerability is scored MEDIUM (5.4 CVSS), it should be prioritized based on your Keycloak deployment model. If you use FGAP v2 for multi-tenant isolation or to enforce strict admin boundaries in a sensitive environment, treat this as HIGH priority because it directly undermines your access control model. If FGAP v2 is not enabled or your admin team is fully trusted and isolated, priority can be lower. This is not a CISA Known Exploited Vulnerability, but the attack surface is low and impact is direct.

Risk score, explained

CVSS 5.4 reflects: (1) requirement for valid admin credentials (Low Attack Vector mitigated by Privileges Required), (2) no user interaction needed, (3) limited scope (affects only token claims and scope assignments, not system availability), (4) modest but real confidentiality and integrity impact (unauthorized data injection). The score does not account for business context; organizations enforcing FGAP v2 for compliance or multi-tenancy should elevate operational risk even if base CVSS is medium.

Frequently asked questions