CVE-2026-16106 Overview
CVE-2026-16106 is a missing authorization vulnerability [CWE-862] in the Keycloak admin REST API. Keycloak is an open source identity and access management (IAM) solution developed by Red Hat. The flaw occurs when a delegated administrator removes a child role from a composite role. The endpoint fails to verify whether the caller is authorized to manage the specific child role being removed.
An attacker with limited administrative permissions can strip privileged roles from composite roles they do not own. This causes other users and administrators to lose access tied to those roles.
Critical Impact
Delegated administrators can remove privileged roles they are not authorized to manage, disrupting access for legitimate users and administrators.
Affected Products
- Red Hat Keycloak (admin REST API)
- Red Hat Build of Keycloak
- Red Hat Single Sign-On downstream distributions
Discovery Timeline
- 2026-07-17 - CVE-2026-16106 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-16106
Vulnerability Analysis
The vulnerability resides in the Keycloak admin REST API path that manages composite role membership. Composite roles in Keycloak aggregate one or more child roles. Removing a child role should require authorization over both the composite role and the child role being detached.
The affected endpoint checks only the caller's rights over the composite role. It does not validate rights over the child role targeted for removal. A delegated administrator with manage permissions on a low-privilege composite role can therefore remove references to high-privilege child roles from that composite.
When users inherit privileges through the composite, removing a child role revokes their effective access. The result is an integrity impact on the role graph and a functional denial of service for users and administrators who depended on the inherited permissions.
Root Cause
The root cause is a missing authorization check [CWE-862] on the child role parameter during composite role modification. The API enforces access control on the parent composite role but omits an equivalent check on each child role passed in the request body.
Attack Vector
Exploitation requires network access to the Keycloak admin API and valid credentials for an account with delegated administrative permissions. The attacker issues a DELETE request against the composite roles endpoint, specifying a privileged child role in the payload. The server processes the removal without verifying authorization over that child role.
See the Red Hat CVE-2026-16106 Advisory and Red Hat Bug Report #2501739 for vendor technical details.
Detection Methods for CVE-2026-16106
Indicators of Compromise
- Unexpected DELETE requests to /admin/realms/{realm}/roles-by-id/{id}/composites or equivalent role composite endpoints from delegated administrator accounts.
- Keycloak admin event logs showing REMOVE_COMPOSITE_ROLE operations targeting privileged roles by non-owner administrators.
- Sudden loss of access reports from users whose permissions derive from composite role membership.
Detection Strategies
- Enable Keycloak admin events with representation logging and alert on REMOVE_COMPOSITE_ROLE operations affecting realm-management or high-privilege roles.
- Correlate the acting user's assigned role scopes with the child role removed in each event to flag actions outside the actor's authorized scope.
- Baseline normal composite role modification patterns per administrator and alert on deviations.
Monitoring Recommendations
- Forward Keycloak admin event logs to a centralized SIEM or data lake for retention and correlation.
- Monitor authentication and API activity for delegated administrator accounts, prioritizing accounts with narrow scopes issuing broad role changes.
- Track role graph changes over time to identify unauthorized structural modifications to composite roles.
How to Mitigate CVE-2026-16106
Immediate Actions Required
- Apply vendor patches referenced in the Red Hat CVE-2026-16106 Advisory as soon as they are available for your distribution.
- Audit all delegated administrator accounts and remove unnecessary manage-realm or composite role management permissions.
- Review recent composite role changes and restore any child role assignments removed without authorization.
Patch Information
Red Hat tracks remediation for this issue under Red Hat Bug Report #2501739. Consult the vendor advisory for fixed package versions covering Red Hat Build of Keycloak and downstream distributions. Upgrade upstream Keycloak deployments to the version incorporating the authorization check fix.
Workarounds
- Restrict the manage-realm and role management permissions to a small set of trusted administrators until patches are applied.
- Use fine-grained admin permissions to scope delegated administrators strictly to the roles they own, avoiding overlap with privileged composite roles.
- Enable and review Keycloak admin events continuously so unauthorized composite role modifications can be detected and reverted quickly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
