CVE-2026-17526
No fix known EPSS <1%CVSS 7.2
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.
Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.16, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.7, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7