CVE-2026-14614 Overview
CVE-2026-14614 is a broken access control flaw [CWE-284] in the ClientResource component of Keycloak's admin services. The issue occurs when Fine-Grained Admin Permissions (FGAP) v2 is enabled. A delegated administrator with limited scope over specific clients can attach or remove hidden client scopes that they are not authorized to see or manage. Manipulating these scopes lets an attacker inject unauthorized claims or permissions into security tokens issued to end-users. Downstream applications relying on those tokens may then grant higher access than intended.
Critical Impact
A low-privileged delegated Keycloak administrator can tamper with client scopes to alter issued tokens, enabling privilege escalation in relying applications.
Affected Products
- Red Hat build of Keycloak with Fine-Grained Admin Permissions (FGAP) v2 enabled
- Keycloak admin services exposing the ClientResource endpoint
- Applications consuming tokens issued by an affected Keycloak realm
Discovery Timeline
- 2026-07-03 - CVE-2026-14614 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14614
Vulnerability Analysis
The flaw resides in Keycloak's ClientResource admin API, which manages client configuration including associated client scopes. Client scopes control which claims, roles, and protocol mappers are added to issued OIDC and SAML tokens. Under FGAP v2, administrators can be delegated authority over specific clients while other scopes remain hidden from them. The ClientResource component fails to fully enforce this boundary when handling scope attachment and detachment operations. A delegated admin can therefore reference client scopes outside their permission set and bind or unbind them from a client they control.
Because client scopes drive token composition, an attacker can inject additional claims or protocol mappers, or strip scopes that carry security-relevant constraints. Relying applications that trust the issuer then process tokens containing elevated roles, group memberships, or audience values. This turns a scoped admin role into a path for privilege escalation across the federated ecosystem.
Root Cause
The root cause is missing authorization checks on referenced client scope identifiers within the ClientResource scope management operations. FGAP v2 validates the target client but does not consistently validate the caller's permission to manage the referenced scope object, breaking the least-privilege model that FGAP is intended to enforce.
Attack Vector
Exploitation requires a network-reachable Keycloak admin endpoint and authenticated access as a delegated administrator with permissions over at least one client. The attacker issues admin REST API calls against ClientResource to attach a hidden client scope containing privileged mappers, then triggers token issuance through normal authentication flows. No user interaction is required. Verified proof-of-concept code is not publicly available at the time of publication.
Detection Methods for CVE-2026-14614
Indicators of Compromise
- Admin REST API calls to PUT /admin/realms/{realm}/clients/{id}/default-client-scopes/{scopeId} or optional-client-scopes originating from delegated admin accounts referencing scope IDs outside their normal management set.
- Unexpected additions or removals of client scopes in Keycloak admin event logs (CLIENT_UPDATE, CLIENT_SCOPE_UPDATE) attributed to non-realm-admin service accounts.
- Issued tokens containing claims, audiences, or roles that do not match the client's historical scope configuration.
Detection Strategies
- Enable Keycloak admin events and alert on scope attachment or detachment actions performed by any account that is not a full realm administrator.
- Baseline the set of client scopes attached to each client and diff periodically to detect unauthorized modifications.
- Correlate token issuance logs with recent admin events to identify tokens issued shortly after suspicious scope changes.
Monitoring Recommendations
- Ship Keycloak admin and event logs to a centralized SIEM and retain them for forensic review.
- Monitor authentication traffic for tokens containing unexpected scope, aud, or role claims for a given client.
- Audit FGAP v2 permission assignments monthly to ensure delegated administrators hold only the scopes required for their role.
How to Mitigate CVE-2026-14614
Immediate Actions Required
- Review all delegated administrator role assignments granted through FGAP v2 and remove unnecessary client management permissions.
- Audit client scope configurations across every realm to detect unauthorized additions or removals.
- Restrict access to the Keycloak admin REST API to trusted management networks only.
Patch Information
Refer to the Red Hat CVE-2026-14614 Advisory and Red Hat Bugzilla Report #2496889 for fixed package versions and errata as they become available. Apply the vendor-supplied update to affected Keycloak or Red Hat build of Keycloak deployments.
Workarounds
- Disable Fine-Grained Admin Permissions v2 and revert to full realm administrator delegation where operationally acceptable until a patch is applied.
- Remove sensitive protocol mappers and roles from client scopes that are not intended to be attached to every client, reducing the impact of unauthorized scope binding.
- Enforce strict token validation in relying applications, including audience and issuer checks, and reject tokens carrying unexpected claims.
# Configuration example: audit current client scope bindings for a realm
kcadm.sh get clients -r myrealm --fields 'clientId,defaultClientScopes,optionalClientScopes' > clients-scopes-baseline.json
# Compare against a later snapshot to detect unauthorized modifications
diff clients-scopes-baseline.json clients-scopes-current.json
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
