CVE-2026-4629 PUBLISHED

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

Assigner: redhat
Reserved: 23.03.2026 Published: 30.06.2026 Updated: 30.06.2026

A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6.5

Product Status

Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Credits

  • Red Hat would like to thank Daniel Peters (Operating Intelligence Inc.), Lior Moshe (Operating Intelligence Inc.), and Uri Rolls (Operating Intelligence Inc.) for reporting this issue.

References

Problem Types

  • Incorrect Privilege Assignment CWE