CVE-2026-9795: Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-10-26
Weakness: CWE-266

Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

Affected products

Red Hat build of Keycloak 26.4: all versions

References

Get alerted when CVE-2026-9795 or the next vulnerability affects your stack