CVE-2026-4629: Keycloak Privilege Escalation via Role Mapper Injection

Technical summary

CVE-2026-4629 is a privilege escalation vulnerability in Keycloak arising from insufficient validation of role mapper configuration. An authenticated user holding `manage-clients` permission can programmatically inject a hardcoded role mapper into any client application. The injected mapper manipulates token generation logic to unconditionally assert the `realm-admin` role in issued tokens, circumventing scope restrictions and attribute-based access control policies. The vulnerability maps to CWE-266 (Improper Privilege Management) and stems from a trust boundary violation between client configuration endpoints and token assertion mechanisms.

Business impact

This vulnerability enables insider threats and compromised administrator accounts to escalate privileges without detection. An attacker with client management rights—such as a rogue service administrator or operator with delegated permissions—can assume full realm administrative capabilities, including user provisioning, policy modification, secret rotation, and audit log manipulation. Organizations relying on Keycloak's role-based access control (RBAC) for multi-tenant isolation face significant risk if a lower-privileged account is breached or an insider has malicious intent.

Affected systems

Red Hat Build of Keycloak is confirmed affected. Other Keycloak distributions (community, vendor-supplied) are likely affected unless patched; verify with your specific distribution's security advisory. The vulnerability impacts all realms within an affected instance and all client applications that trust tokens issued by that realm.

Exploitability

While exploitability requires high privileges (`manage-clients` permission), the attack is straightforward once that permission is held. No user interaction is needed, and the vulnerability is accessible over the network. The barrier to exploitation is high privilege level, not technical complexity. If client management access is available to delegated administrators, service accounts, or shared credentials, the risk increases significantly.

Remediation

Apply security updates released by your Keycloak vendor (Red Hat, distributions, or community project). Verify patch availability in your vendor's security advisory—specific version numbers must be confirmed against official guidance. Until patching is possible, restrict `manage-clients` permission to only the most trusted administrators and enable comprehensive auditing of client configuration changes. Consider network segmentation to limit who can interact with Keycloak administration endpoints.

Patch guidance

Contact your Keycloak vendor or check their security advisory portal for available patches. For Red Hat Build of Keycloak, consult Red Hat's customer portal or publicly available security advisories. Apply patches to all Keycloak instances in your environment, including development and staging environments that may be used to test client configurations. Verify patch application by confirming version numbers match vendor guidance and testing role mapper injection is rejected on updated systems.

Detection guidance

Monitor Keycloak's audit logs for client configuration modifications, particularly changes to mappers or protocol configurations. Alert on any client receiving a new role mapper claiming to assert realm-admin or other high-privilege roles. Review client credentials and service account permissions to identify accounts holding `manage-clients` privileges. Inspect active tokens (via token introspection or logs) for unexpected realm-admin role assertions originating from standard client applications. Correlate suspicious role additions with authentication events from the same source IP or account.

Why prioritize this

Although marked MEDIUM severity due to the high privilege requirement, organizations should treat this as priority if client management is delegated, if service accounts have these permissions, or if administrator account compromise is a credible threat model. The consequence—full realm compromise—is severe, and the privilege prerequisite can be satisfied through common delegation patterns in larger deployments.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects high privileges required (PR:H) balanced against high impact on confidentiality and integrity (C:H, I:H) with no availability impact (A:N). Network accessibility (AV:N) and low attack complexity (AC:L) elevate the score. The rating assumes the attacker must already hold privileged credentials; however, the severity of impact—full administrative compromise—warrants close attention regardless of the numeric score.

Frequently asked questions