CVE-2026-9795: Keycloak FGAPv2 Fine-Grained Admin Permissions Bypass

Technical summary

CVE-2026-9795 affects Keycloak's FGAPv2 authorization model. The vulnerability exists in scope mapping enforcement: an administrator with confined client management permissions can manipulate client role mappings to include realm-level roles that should be restricted by their administrative scope. Because FGAPv2 is designed to compartmentalize admin capabilities, this represents a direct bypass of the intended permission hierarchy. When a user logs into the affected client, the OpenID Connect token (id_token or access_token) includes the injected realm roles, allowing the client application to treat the user as if they possessed those privileges. The vulnerability requires high privilege (PR:H) and user interaction (UI:R), but affects cross-realm scope (S:C), meaning the blast radius extends beyond a single isolated system.

Business impact

If an organization uses Keycloak to centralize identity and access management across multiple applications and realms, a compromised or malicious admin account can escalate privileges across all dependent systems simultaneously. Clients relying on Keycloak's role assertions for authorization decisions may grant sensitive permissions (e.g., financial transactions, data export, account modification) to unauthenticated or under-privileged users. This directly impacts compliance posture if role-based access control (RBAC) is audited or mandated by regulation. Recovery requires token revocation, session termination, and role audit across all affected applications.

Affected systems

Red Hat build of Keycloak is the confirmed affected product. This includes all deployments using Keycloak's FGAPv2 feature for administrative role delegation. Organizations using Keycloak as a central authentication provider for SaaS applications, microservices, or federated identity scenarios are at risk. The vulnerability is scoped to admins with client management rights, so air-gapped or highly restricted admin environments face lower exposure; however, any organization with multiple admins or delegated administrative privileges should assess their current FGAPv2 configuration.

Exploitability

Exploitation requires an authenticated administrator account with client management permissions—a high-privilege prerequisite that limits immediate external attack surface. However, the required user interaction (UI:R in the CVSS vector) is minimal and may be satisfied by the attacker's own admin session. The attack is deterministic once an admin account is compromised or maliciously provisioned, making it attractive in insider threat scenarios or post-compromise persistence strategies. No public exploit code or active exploitation in the wild has been reported to date (KEV status: not listed).

Remediation

Organizations must apply patches from Red Hat as they become available. Until patching is feasible, implement compensating controls: audit admin account creation and scope assignments, restrict client management permissions to a minimal set of trusted personnel, and enforce multi-factor authentication for all admin accounts. Review recent scope mappings and role assignments to clients; any unexpected high-privilege roles should be revoked immediately. Consider disabling FGAPv2 temporarily if your security posture permits, reverting to role-based admin access pending patched deployment.

Patch guidance

Verify Red Hat's official Keycloak advisory for patched versions. Apply updates to all Keycloak instances in your infrastructure, including development, staging, and production environments. Given the cross-realm impact (S:C vector), a staggered rollout with careful pre-production testing is recommended to ensure no role-dependent workflows break. After patching, re-test FGAPv2 permission boundaries to confirm the fix; Red Hat's advisory will include validation steps.

Detection guidance

Enable Keycloak's audit logging and export logs to a SIEM. Search for admin actions that assign realm roles to client scope mappings, particularly assignments of high-privilege roles (e.g., 'admin', 'manage-users', 'manage-roles') by accounts with limited permissions. Monitor token content (via JWT inspection or OIDC introspection endpoints) for unexpected role inflation in tokens issued to a specific client. Set alerts for scope mapping modifications by any admin account. Review cross-realm token flows if your deployment spans multiple realms; unexplained realm-role propagation to child realms is a leading indicator.

Why prioritize this

This vulnerability scores HIGH (7.3 CVSS) due to high confidentiality and integrity impact (C:H/I:H), despite requiring high privilege and user interaction to exploit. The cross-realm scope (S:C) means a single compromise can affect multiple applications and user populations. The fine-grained permissions feature is typically deployed in organizations with complex administrative hierarchies or multi-tenant SaaS platforms, amplifying blast radius. While not yet in the Known Exploited Vulnerabilities catalog, the low complexity (AC:H) and intuitive attack path make it attractive to insiders or post-compromise persistence actors. Organizations using Keycloak for sensitive workloads should treat this as high priority for immediate audit and patching.

Risk score, explained

CVSS 7.3 reflects: (1) high confidentiality impact—users gain unauthorized access to sensitive data or functionality; (2) high integrity impact—admin permissions are altered without authorization; (3) no availability impact—the Keycloak system itself remains operational; (4) cross-realm scope amplifies the reach; (5) high privilege requirement and human interaction reduce the attack surface to insider or post-compromise scenarios. The score does not account for organizational context; environments where Keycloak controls access to critical systems or PII should consider their own risk as CRITICAL regardless of CVSS.

Frequently asked questions