CVE-2026-16105: Keycloak Auth Bypass Vulnerability

CVE-2026-16105 Overview

CVE-2026-16105 is a missing authorization vulnerability [CWE-862] in the RoleContainerResource component of Keycloak. Name-based endpoints in the admin REST API fail to enforce authorization checks when managing composite roles. A delegated administrator with manage-realm permissions can remove essential child roles from built-in admin roles. This action can disrupt administrative functions within a realm and degrade the integrity of the identity provider's role model.

Critical Impact
An authenticated delegated administrator can strip child roles from built-in admin roles, breaking administrative workflows and undermining realm integrity.

Affected Products

Red Hat Keycloak (RoleContainerResource component)
Keycloak admin REST API name-based composite role endpoints
Products embedding the affected Keycloak identity broker

Discovery Timeline

2026-07-31 - CVE-2026-16105 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16105

Vulnerability Analysis

The flaw resides in the RoleContainerResource class, which exposes REST endpoints for managing realm and client roles in Keycloak. Certain endpoints resolve target roles by name rather than by ID. These name-based paths omit the authorization checks applied on their ID-based counterparts. As a result, an attacker holding the manage-realm role can invoke composite role management operations against built-in admin roles. The attacker can remove nested child roles such as manage-users or view-clients from composite admin roles.

The integrity impact is significant because Keycloak enforces administrative permissions through composite role membership. Removing child roles neutralizes the effective privileges granted by an admin role. Legitimate administrators lose the ability to perform expected operations, creating a denial of administrative control condition. The confidentiality of stored credentials is not directly affected, and no code execution occurs.

Root Cause

The root cause is missing authorization [CWE-862] on name-based lookups in RoleContainerResource. Authorization logic is enforced when roles are addressed by their unique identifier but is not consistently applied when the same operations occur through name-based endpoints. This inconsistency allows a delegated admin to bypass intended access boundaries that protect built-in admin roles.

Attack Vector

The attacker must already hold the manage-realm permission in a Keycloak realm. Using the admin REST API, the attacker issues composite role management requests that reference target roles by name. The requests remove child roles from built-in admin roles, degrading the privilege of legitimate administrators. Network access to the Keycloak admin API is required, and no user interaction is needed.

See the Red Hat CVE-2026-16105 Advisory and Red Hat Bug Report #2501738 for vendor technical details.

Detection Methods for CVE-2026-16105

Indicators of Compromise

Unexpected DELETE or composite role modification requests to /admin/realms/{realm}/roles/{role-name}/composites endpoints in Keycloak access logs.
Audit events showing removal of child roles from built-in admin roles such as realm-admin, manage-users, or manage-clients.
Administrative users reporting sudden loss of expected permissions in a realm.

Detection Strategies

Enable Keycloak event listeners and forward admin events to a centralized log store for review of DELETE_ROLE and role composite update operations.
Baseline the membership of built-in admin composite roles and alert on deviations.
Correlate manage-realm role assignments with subsequent admin API calls that modify built-in role composites.

Monitoring Recommendations

Ingest Keycloak admin event logs into a SIEM and build detections for changes to protected built-in role composites.
Monitor for privilege reductions applied to service accounts and admin accounts within short time windows.
Track any use of name-based role endpoints against realms hosting privileged tenants.

How to Mitigate CVE-2026-16105

Immediate Actions Required

Apply the Keycloak security update referenced in the Red Hat CVE-2026-16105 Advisory as soon as it is available for your distribution.
Review current assignments of the manage-realm role and remove the permission from accounts that do not require it.
Audit built-in admin composite roles for missing child roles and restore expected membership.

Patch Information

Red Hat has published tracking information for CVE-2026-16105 in the Red Hat CVE Advisory and Bugzilla #2501738. Consult these references for fixed versions applicable to Red Hat Build of Keycloak and Red Hat Single Sign-On distributions.

Workarounds

Restrict the manage-realm role to a minimum set of trusted operators until the patch is applied.
Place the Keycloak admin API behind network access controls that limit which identities and networks can reach /admin/realms/* endpoints.
Regularly export realm configuration so composite role membership can be restored quickly if tampering is detected.

bash

# Example: export a realm configuration for backup before applying changes
/opt/keycloak/bin/kc.sh export \
  --dir /var/backups/keycloak \
  --realm my-realm \
  --users realm_file