CVE-2026-94213: Keycloak Information Disclosure Vulnerability

CVE-2026-94213 Overview

CVE-2026-94213 is a missing authorization vulnerability [CWE-862] in the Authorization Services component of Keycloak, an open-source identity and access management platform. The flaw resides in the policy evaluation endpoint that administrators use to test how access policies apply to specific users. Missing authorization checks allow a delegated administrator with limited viewing privileges to retrieve the full profile and role information of any user in the realm. Exposed data includes email addresses and assigned security roles, even when the caller lacks permission to view user details.

Critical Impact
A delegated administrator with restricted privileges can enumerate sensitive user profile and role data across an entire Keycloak realm through the policy evaluation endpoint.

Affected Products

Keycloak (Authorization Services component)
Red Hat build of Keycloak
Red Hat Single Sign-On distributions incorporating the affected component

Discovery Timeline

2026-09-21 - CVE-2026-94213 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94213

Vulnerability Analysis

The vulnerability sits in Keycloak's Authorization Services policy evaluation endpoint. This administrative endpoint simulates policy decisions to help administrators verify that role-based and attribute-based access rules resolve correctly for a given user. To return an accurate simulation, the endpoint reads the target user's profile attributes and role mappings.

The endpoint enforces coarse-grained administrative authentication but does not re-check whether the calling delegated administrator has permission to read the specific user being evaluated. As a result, an administrator whose scope is intentionally narrowed, for example one restricted to managing clients or policies without user-view rights, can invoke the endpoint against any user identifier in the realm and receive privileged user data in the response.

The exposed information includes email addresses, profile attributes, and the complete set of assigned realm and client roles. This turns a policy-testing feature into a user enumeration and role-disclosure primitive within multi-tenant or delegated-administration deployments.

Root Cause

The root cause is a missing authorization check [CWE-862] on the policy evaluation endpoint. The handler validates that the caller holds an administrative session but does not evaluate the caller's fine-grained permissions against the target user resource before returning profile and role data. Least-privilege boundaries defined through Keycloak's fine-grained admin permissions are therefore bypassed for this specific code path.

Attack Vector

Exploitation requires network access to the Keycloak administration API and an authenticated delegated administrator account with any privileges sufficient to reach the Authorization Services tooling. No user interaction is required. The attacker issues policy evaluation requests referencing arbitrary user identifiers in the target realm and parses the responses to harvest email addresses and role assignments. No authoritative public exploit code is referenced in the advisory; see the Red Hat CVE-2026-94213 Advisory and Red Hat Bug Report #2537310 for vendor technical details.

Detection Methods for CVE-2026-94213

Indicators of Compromise

Repeated POST requests from a single delegated administrator account to the Authorization Services policy evaluation endpoint referencing many distinct user identifiers.
Administrative API responses containing user profile fields, such as email and role mappings, returned to accounts that lack the view-users role.
Sequential or scripted enumeration patterns targeting user UUIDs within a short time window.

Detection Strategies

Correlate Keycloak admin event logs with the caller's assigned roles and alert when policy evaluation calls are made by principals without view-users or equivalent scope.
Baseline normal policy evaluation usage per administrator and flag deviations in request volume or in the diversity of target user identifiers.
Ingest Keycloak audit events into a centralized SIEM or data lake and build detections that join administrator role assignments with sensitive endpoint access.

Monitoring Recommendations

Enable Keycloak admin events with representation payloads and forward them to a centralized logging pipeline.
Monitor reverse proxy access logs for requests to Authorization Services evaluation paths and track per-account request rates.
Review delegated administrator role assignments periodically to confirm they align with intended least-privilege boundaries.

How to Mitigate CVE-2026-94213

Immediate Actions Required

Apply the Keycloak or Red Hat build of Keycloak update referenced in the Red Hat CVE-2026-94213 Advisory as soon as it is available for your distribution.
Audit accounts holding delegated administrative roles and remove any that are not strictly required.
Rotate exposed credentials or notify users whose email addresses and role assignments may have been disclosed if log review indicates suspicious enumeration.

Patch Information

Red Hat tracks the fix under Red Hat Bug Report #2537310. Consult the vendor advisory for the exact fixed versions applicable to upstream Keycloak and Red Hat build of Keycloak deployments. Upgrade to the patched release, then verify that the policy evaluation endpoint enforces the caller's fine-grained permissions on the target user.

Workarounds

Restrict network access to the Keycloak administration API so that only trusted management hosts can reach the policy evaluation endpoint.
Reduce the number of delegated administrators and avoid granting Authorization Services access to accounts that do not also legitimately require view-users.
Enable and actively review Keycloak admin events to detect abuse until the patch is deployed.

bash

# Example: restrict admin API exposure at a reverse proxy (nginx)
location /admin/ {
    allow 10.0.0.0/24;   # management network
    deny  all;
    proxy_pass http://keycloak_backend;
}

location /realms/master/protocol/ {
    proxy_pass http://keycloak_backend;
}