CVE-2026-4629: Keycloak Privilege Escalation Vulnerability

CVE-2026-4629 Overview

CVE-2026-4629 is a privilege escalation vulnerability in Red Hat Build of Keycloak. A user holding the manage-clients permission can inject a hardcoded role mapper into any client. This action bypasses existing scope restrictions and injects the realm-admin role into generated tokens. The result is full administrative access to the realm, enabling the attacker to control all identity and access management functions.

The flaw is tracked under [CWE-266: Incorrect Privilege Assignment]. It affects deployments where the manage-clients role is delegated to non-administrative users. Red Hat published the advisory on June 30, 2026.

Critical Impact
A user with manage-clients permission can escalate to realm-admin, obtaining full administrative control over the Keycloak realm and all federated applications.

Affected Products

Red Hat Build of Keycloak
Deployments exposing the manage-clients role to non-administrative principals
Clients configured to accept hardcoded role mappers

Discovery Timeline

2026-06-30 - CVE-2026-4629 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-4629

Vulnerability Analysis

Keycloak provides fine-grained role mappers that clients apply when issuing access tokens. The manage-clients permission allows a principal to create and modify client configurations, including their protocol mappers. This permission is intended to be narrower than realm administration.

The vulnerability stems from insufficient validation when a hardcoded role mapper is attached to a client. The mapper can specify the realm-admin role, which Keycloak then embeds in tokens issued for that client. Existing scope restrictions do not filter role mappers of this type. Any authenticated session against the modified client receives tokens carrying realm-admin privileges.

The issue is classified as Incorrect Privilege Assignment [CWE-266]. It converts a client-management delegation into unrestricted realm control.

Root Cause

The root cause is missing authorization enforcement on the role targets available to hardcoded role mappers. Keycloak trusts the manage-clients role to configure mappers without verifying whether the mapped role exceeds the caller's own privileges. This violates the principle of least privilege between the client-management boundary and realm administration.

Attack Vector

An attacker authenticates to the Keycloak administrative API with an account holding manage-clients. The attacker selects a client, adds a hardcoded role protocol mapper referencing realm-admin, and saves the configuration. The attacker then authenticates against that client to obtain a token containing the realm-admin role. The token grants full administrative operations across the realm, including user creation, credential resets, and identity provider changes.

Exploitation requires an existing privileged account and does not require user interaction. No public proof-of-concept or exploit code is reported at this time.

Detection Methods for CVE-2026-4629

Indicators of Compromise

New or modified hardcoded role mappers on client configurations that reference realm-admin or other realm-level roles.
Tokens issued to clients containing realm-admin in the realm_access.roles claim when the client scope does not normally include it.
Administrative API calls originating from accounts that hold only manage-clients but perform realm-wide operations.
Unexpected changes to client protocol mapper collections captured in Keycloak admin event logs.

Detection Strategies

Enable Keycloak admin events and parse CLIENT_UPDATE and PROTOCOL_MAPPER_CREATE entries for oidc-hardcoded-role-mapper types referencing privileged roles.
Compare issued token claims against expected client scopes to flag privilege drift.
Alert when accounts with manage-clients but not realm-admin create or modify role mappers.

Monitoring Recommendations

Forward Keycloak admin and login events to a centralized logging platform with retention for forensic review.
Baseline the set of protocol mappers per client and alert on deviations.
Track token issuance patterns per client, focusing on sudden appearance of high-privilege roles in access_token claims.

How to Mitigate CVE-2026-4629

Immediate Actions Required

Audit all Keycloak clients for hardcoded role mappers referencing realm-admin or other privileged realm roles and remove unauthorized entries.
Review the set of users and service accounts that hold the manage-clients role and revoke it where not required.
Rotate credentials and invalidate active sessions for any account suspected of exploiting the flaw.
Apply the vendor patch referenced in the Red Hat CVE-2026-4629 Advisory as soon as it is available for your deployment.

Patch Information

Red Hat tracks the fix under Red Hat Bug Report #2450244. Consult the Red Hat CVE-2026-4629 Advisory for fixed package versions and errata applicable to your Red Hat Build of Keycloak channel.

Workarounds

Restrict the manage-clients role to trusted administrators only, treating it as equivalent to realm administration until patched.
Remove or disable hardcoded role mappers on clients that do not require them, and disallow their creation through change-control processes.
Enforce approval workflows for client configuration changes using external CI/CD tooling rather than direct admin console access.

bash

# Configuration example: list clients and inspect hardcoded role mappers via kcadm
kcadm.sh config credentials --server https://keycloak.example.com --realm master --user admin
kcadm.sh get clients -r <realm> --fields id,clientId
kcadm.sh get clients/<client-id>/protocol-mappers/models -r <realm> \
  | jq '.[] | select(.protocolMapper=="oidc-hardcoded-role-mapper")'
# Remove an unauthorized mapper
kcadm.sh delete clients/<client-id>/protocol-mappers/models/<mapper-id> -r <realm>