CVE-2026-18571: Keycloak Privilege Escalation Vulnerability

CVE-2026-18571 Overview

CVE-2026-18571 is an authorization bypass vulnerability in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. A sub-administrator with permission to create users can add newly created users to any group, including groups the sub-administrator is not authorized to manage. This breaks the group-scoping boundary that FGAP V2 is designed to enforce. The flaw maps to CWE-862: Missing Authorization and can lead to unauthorized access to sensitive information or elevated privileges for the created accounts.

Critical Impact
A sub-administrator can assign attacker-controlled user accounts to privileged groups, escalating access beyond their delegated scope.

Affected Products

Red Hat Keycloak deployments with Fine-Grained Admin Permissions V2 (FGAP V2) enabled
Red Hat Build of Keycloak
Red Hat Single Sign-On (SSO) distributions incorporating the affected component

Discovery Timeline

2026-08-02 - CVE-2026-18571 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18571

Vulnerability Analysis

Keycloak's Fine-Grained Admin Permissions V2 model allows tenants to delegate administrative actions to sub-administrators scoped to specific realms, groups, or clients. The user creation workflow accepts an initial group membership assignment as part of the create-user operation. When FGAP V2 is enabled, the workflow validates that the caller can create users but fails to validate that the caller is authorized to manage each target group referenced in the request. A sub-administrator can therefore create a user and attach that user to any group in the realm, including administrative or highly privileged groups.

The downstream impact depends on group role bindings. If the target group carries realm-management roles, client roles, or access to sensitive resources, the newly created user inherits those privileges immediately. The sub-administrator can authenticate as the new user or hand credentials to a colluding party, effectively laundering privileges through the creation flow.

Root Cause

The root cause is missing authorization on group assignment during user creation. Authorization checks are applied to the parent action (create user) but not to each nested group membership. This is a classic [CWE-862] pattern where a composite operation inherits the permission of its outermost verb rather than validating each sub-resource independently.

Attack Vector

Exploitation requires an authenticated sub-administrator account that already holds the manage-users or equivalent permission in a realm running FGAP V2. The attacker issues a standard Admin REST API user-creation request with a groups attribute referencing groups outside their delegated scope. Keycloak accepts the request and persists the memberships. The high attack complexity in the CVSS vector reflects the prerequisite of a pre-existing privileged-but-scoped administrator account and an FGAP V2-enabled realm.

No verified proof-of-concept code has been published. See the Red Hat CVE-2026-18571 Advisory and Red Hat Bug Report #2509759 for vendor technical detail.

Detection Methods for CVE-2026-18571

Indicators of Compromise

Admin event log entries of type CREATE on resource USER where the payload includes groups referencing groups outside the caller's delegated scope.
New user accounts appearing in privileged groups (for example, realm-admins, platform-admins) without corresponding GROUP_MEMBERSHIP admin events issued by a full realm administrator.
Sub-administrator accounts issuing POST /admin/realms/{realm}/users requests with unexpected group identifiers.

Detection Strategies

Enable Keycloak admin event logging with includeRepresentation=true and forward events to a SIEM to correlate user creation with group assignments.
Baseline which administrators are authorized to manage each group and alert on user-creation events that add members to groups outside the caller's authorized set.
Review realm-management role inheritance for all groups and flag any user creation that grants transitive realm-admin or manage-realm roles.

Monitoring Recommendations

Continuously audit membership of high-privilege groups and alert on deltas outside change-management windows.
Monitor Admin REST API traffic to /admin/realms/{realm}/users for requests containing a populated groups array from delegated administrators.
Track authentication events for newly created users, particularly first logins that immediately exercise administrative endpoints.

How to Mitigate CVE-2026-18571

Immediate Actions Required

Apply the Keycloak update referenced in the Red Hat CVE-2026-18571 Advisory as soon as it is available for your distribution.
Inventory all realms with FGAP V2 enabled and identify sub-administrators holding user-creation permissions.
Audit recent user-creation events for out-of-scope group assignments and remediate any unauthorized memberships.
Rotate credentials and review sessions for users created by delegated administrators during the exposure window.

Patch Information

Red Hat tracks remediation under the advisory published at access.redhat.com/security/cve/CVE-2026-18571. Consult the advisory for fixed package versions applicable to Red Hat Build of Keycloak and Red Hat Single Sign-On. Upstream Keycloak users should upgrade to the release incorporating the group-assignment authorization check referenced in Red Hat Bug Report #2509759.

Workarounds

Disable Fine-Grained Admin Permissions V2 (FGAP V2) in affected realms until a fixed version is deployed, reverting to the prior permissions model where feasible.
Revoke the manage-users permission from sub-administrators who do not require it, reducing the population of accounts able to trigger the flaw.
Restrict role bindings on sensitive groups so that adding a user to the group does not grant realm-management privileges without an additional approval step.

bash

# Example: temporarily disable FGAP V2 on a Keycloak server (adjust to your distribution)
# Remove the feature flag from the startup arguments and restart the service.
./kc.sh build --features-disabled=admin-fine-grained-authz-v2
./kc.sh start