What’s Vulnerable › Vulnerabilities
CVE-2026-4636: Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-04-02 · updated 2026-10-26
- Weakness: CWE-551
Description
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
Affected products
- Red Hat build of Keycloak 26.4: 26.2, 26.2.15, 26.4, 26.4.11
References
- https://access.redhat.com/errata/RHSA-2026:6475
- https://access.redhat.com/errata/RHSA-2026:6476
- https://access.redhat.com/errata/RHSA-2026:6477
- https://access.redhat.com/errata/RHSA-2026:6478
- https://access.redhat.com/security/cve/CVE-2026-4636
- https://bugzilla.redhat.com/show_bug.cgi?id=2450251
- https://access.redhat.com/errata/RHSA-2026:6475
- https://access.redhat.com/errata/RHSA-2026:6476
- https://access.redhat.com/errata/RHSA-2026:6477
- https://access.redhat.com/errata/RHSA-2026:6478
- https://access.redhat.com/security/cve/CVE-2026-4636
- https://bugzilla.redhat.com/show_bug.cgi?id=2450251
Get alerted when CVE-2026-4636 or the next vulnerability affects your stack