CVE-2026-17059: Keycloak Information Disclosure Flaw

CVE-2026-17059 Overview

CVE-2026-17059 is an authorization flaw in the role-users endpoint of the keycloak-services library, a core component of the Keycloak identity and access management platform. The endpoint fails to verify whether an administrator has permission to view individual users when listing the members of a role. A restricted administrator can enumerate private user attributes, including names and email addresses, for accounts outside their intended scope. The weakness is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Restricted Keycloak administrators can read personally identifiable information for users they are not authorized to access, breaking multi-tenant isolation guarantees.

Affected Products

Keycloak identity and access management server
keycloak-services library (upstream component)
Red Hat build of Keycloak (see Red Hat CVE-2026-17059 Advisory)

Discovery Timeline

2026-07-24 - CVE-2026-17059 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-17059

Vulnerability Analysis

The role-users endpoint exposes the members of a given realm or client role. When an administrator queries this endpoint, Keycloak returns user representations that include private attributes such as firstName, lastName, email, and username. The vulnerable code path checks that the caller can view the role, but it does not re-check the per-user view-users authorization for each member returned in the list.

As a result, an authenticated administrator with narrow, delegated permissions receives user data that should be filtered based on their scope. The flaw does not permit modification of user data or account takeover on its own, but it discloses information useful for phishing, account enumeration, and follow-on attacks against tenants managed within the same realm.

Root Cause

The root cause is a missing authorization check inside the collection handler for role members. The endpoint applies a single coarse-grained check for the role query rather than iterating through the result set and applying the same evaluatePermission call that guards the single-user users/{id} endpoint. This is a textbook CWE-639 pattern where an object reference is honored without confirming the caller's rights to that specific object.

Attack Vector

Exploitation requires network access to the Keycloak admin REST API and valid credentials for a low-privileged administrator that holds the view-clients or query-users scope but not view-users on the target realm. The attacker issues a standard GET request against /admin/realms/{realm}/roles/{role-name}/users or the client-role variant, then parses the returned JSON for user attributes. No user interaction is required, and the attack complexity is low. See the Red Hat Bug Report #2506746 for the vendor's technical description.

Detection Methods for CVE-2026-17059

Indicators of Compromise

Repeated GET requests from a single administrator account to /admin/realms/*/roles/*/users or /admin/realms/*/clients/*/roles/*/users endpoints.
Admin API access patterns that enumerate multiple roles in a short time window from restricted administrator sessions.
Access log entries where the caller lacks the view-users role but successfully retrieves user representations with populated email and firstName fields.

Detection Strategies

Enable Keycloak Admin Events with include representation and alert when restricted administrators query role membership endpoints.
Correlate authentication events with subsequent role-users API calls to identify accounts abusing scoped permissions.
Baseline normal administrator activity per realm and flag deviations in call volume against the roles/{name}/users path.

Monitoring Recommendations

Forward Keycloak admin and event logs to a centralized SIEM for retention and query.
Track the ratio of role-users requests to distinct user identifiers returned, which spikes during enumeration.
Review delegated administrator role assignments quarterly and monitor for privilege drift.

How to Mitigate CVE-2026-17059

Immediate Actions Required

Apply the patched Keycloak release referenced in the Red Hat CVE-2026-17059 Advisory as soon as it is available for your distribution.
Audit fine-grained administrator role assignments and revoke unnecessary query-users, query-clients, and role-view permissions.
Rotate credentials for any restricted administrator accounts suspected of exploiting the endpoint.

Patch Information

Red Hat has published tracking information under CVE-2026-17059 and Bugzilla #2506746. Consult these advisories for the fixed component versions in the Red Hat build of Keycloak and upstream releases of the keycloak-services library. Upgrade all realm servers running vulnerable versions and validate the patch by confirming the role-users endpoint enforces per-user view-users authorization.

Workarounds

Restrict admin API network exposure so only trusted management networks can reach /admin/realms/* endpoints.
Remove delegated administrator roles that grant role visibility without corresponding user visibility until the patch is applied.
Enable and review Keycloak event logging to detect enumeration attempts against role membership endpoints.

bash

# Configuration example: restrict admin API exposure at the reverse proxy
# Example nginx snippet limiting /admin to a management CIDR
location /admin/ {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://keycloak_backend;
}