CVE-2026-9795
Fixed upstream EPSS <1%CVSS 7.3
A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.
Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-26.5 | no fix |
| Chainguard | keycloak-26.5-iamguarded-compat | no fix |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.5 | no fix |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | request-9047-keycloak-fips-26.5 | no fix |
| Chainguard | request-9047-keycloak-fips-26.5-iamguarded-fips | no fix |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |
| Wolfi | keycloak-26.5 | no fix |
| Wolfi | keycloak-26.5-iamguarded-compat | no fix |