CVE-2026-18570: Keycloak Auth Bypass Vulnerability

CVE-2026-18570 Overview

CVE-2026-18570 is a missing authorization flaw [CWE-862] in the full-scope-disabled client-policy executor within the keycloak-services component of Red Hat Build of Keycloak. The executor enforces security policies during client registration and configuration. It only validates the fullScopeAllowed field when that field is explicitly present in a request. A delegated user can omit the field to bypass the policy and register a client with full scope access. The resulting client can obtain tokens with unauthorized role mappings.

Critical Impact
Delegated users can create Keycloak clients that bypass full-scope restrictions and mint tokens carrying role mappings they were never authorized to grant.

Affected Products

Red Hat Build of Keycloak
Keycloak keycloak-services component (full-scope-disabled client-policy executor)
Downstream distributions embedding the affected keycloak-services module

Discovery Timeline

2026-08-02 - CVE-2026-18570 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18570

Vulnerability Analysis

Keycloak client policies allow administrators to constrain how clients are registered or updated. The full-scope-disabled executor is designed to reject any client configuration that sets fullScopeAllowed to true, forcing clients to receive only the role mappings explicitly assigned to their scope.

The executor's validation logic only triggers when the request payload contains the fullScopeAllowed attribute. Requests that omit the field entirely are not evaluated against the policy. Because Keycloak treats an absent field as the server-side default rather than a policy-relevant value, the executor never rejects the operation, and the client is persisted with full scope semantics.

A delegated user with permission to create or update clients can exploit this gap without any elevated privileges. The impact is unauthorized token issuance: tokens minted for the misconfigured client carry role mappings the requester should not be able to grant.

Root Cause

The root cause is missing authorization enforcement on a default code path. The full-scope-disabled executor conditions its check on the presence of fullScopeAllowed in the request rather than on the effective post-merge configuration of the client. This omission is characteristic of [CWE-862] Missing Authorization, where a security decision depends on attacker-controlled input structure instead of the resulting state.

Attack Vector

Exploitation requires network access to the Keycloak admin or client registration endpoints and a delegated account with rights to create or configure clients. The attacker submits a client creation or update request that intentionally omits the fullScopeAllowed field. The policy executor sees no field to validate and permits the operation. The client is created with full scope, and subsequent token requests through that client return tokens containing role mappings beyond the attacker's delegated authority. No user interaction is required.

Refer to the Red Hat CVE-2026-18570 Advisory and Red Hat Bug Report #2509756 for vendor technical details.

Detection Methods for CVE-2026-18570

Indicators of Compromise

Keycloak clients whose stored configuration shows fullScopeAllowed=true in realms where a full-scope-disabled client policy is active.
Admin event logs recording CREATE or UPDATE operations on clients by delegated (non-admin) users, followed by token issuance with expanded role claims.
Access tokens issued by newly registered clients that contain realm or client roles not aligned with the client's assigned scope mappings.

Detection Strategies

Audit all clients in each realm and flag any with fullScopeAllowed=true that were created or modified by non-administrative accounts.
Correlate Keycloak admin events for client registration with the request payloads to identify submissions that omit the fullScopeAllowed field while a full-scope-disabled policy is configured.
Decode issued JWTs from suspect clients and compare the realm_access.roles and resource_access claims against the client's configured scope mappings.

Monitoring Recommendations

Forward Keycloak admin and event logs to a centralized SIEM and alert on client-configuration changes made by delegated users.
Establish a baseline of clients with full scope enabled and alert on any additions to that set.
Monitor token endpoint activity for tokens carrying privileged role claims issued to recently created or modified clients.

How to Mitigate CVE-2026-18570

Immediate Actions Required

Review the Red Hat CVE-2026-18570 Advisory and apply the patched Red Hat Build of Keycloak release once available for your version.
Inventory all Keycloak clients and reset fullScopeAllowed to false on any client that should be constrained by the full-scope-disabled policy.
Restrict manage-clients and create-client role assignments to trusted administrators until patching is complete.

Patch Information

Red Hat tracks remediation in Red Hat Bug Report #2509756. Consult the Red Hat CVE-2026-18570 Advisory for the fixed package versions and errata applicable to your Keycloak deployment. Upstream Keycloak users should track the corresponding keycloak-services fix and upgrade to a release that validates fullScopeAllowed based on the resolved client state rather than request field presence.

Workarounds

Remove client creation and update permissions from delegated (non-admin) users until the patch is deployed.
Enforce client registration through a controlled provisioning pipeline that always sets fullScopeAllowed=false explicitly on every request.
Add a compensating client policy or admin review step that rejects any client whose stored configuration resolves to fullScopeAllowed=true.

bash

# Example: audit clients for fullScopeAllowed=true using kcadm.sh
/opt/keycloak/bin/kcadm.sh config credentials \
  --server https://keycloak.example.com \
  --realm master --user admin

/opt/keycloak/bin/kcadm.sh get clients -r <REALM> \
  --fields id,clientId,fullScopeAllowed \
  | jq '.[] | select(.fullScopeAllowed==true)'