CVE-2026-11986
Fixed upstream EPSS <1%CVSS 4.9
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrator with limited permissions to remove highly privileged roles from other users or groups, potentially disrupting administrative access control.
Products: Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.5, Red Hat JBoss Enterprise Application Platform Expansion Pack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-rest-admin-ui-ext | 26.7.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.5 | no fix |
| Chainguard | keycloak-26.5-iamguarded-compat | no fix |
| Chainguard | keycloak-26.6 | no fix |
| Chainguard | keycloak-26.6-iamguarded-compat | no fix |
| Chainguard | keycloak-fips-26.5 | no fix |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.6 | no fix |
| Chainguard | keycloak-fips-26.6-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.5 | no fix |
| Chainguard | request-9047-keycloak-fips-26.5-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.6 | no fix |
| Chainguard | request-9047-keycloak-fips-26.6-iamguarded-fips | no fix |
| Wolfi | keycloak-26.5 | no fix |
| Wolfi | keycloak-26.5-iamguarded-compat | no fix |
| Wolfi | keycloak-26.6 | no fix |
| Wolfi | keycloak-26.6-iamguarded-compat | no fix |