Is CVE-2026-120984 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120984 being exploited in the wild.

How severe is CVE-2026-120984?

Critical severity, with a CVSS score of 9.1, published 7 November 2026.

Which products and versions are affected?

Red Hat build of Keycloak; Red Hat Single Sign-On; Keycloak Keycloak.

Is there a fix for CVE-2026-120984?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120984 attacked?

It is attacked over the network.

Am I affected by CVE-2026-120984?

Check whether you run Keycloak, Red Hat build of Keycloak or Red Hat Single Sign-On. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120984: Keycloak server arbitrary code execution in client authorization

CVE-2026-120984 · Severity: critical · CVSS 9.1 · Published 2026-11-07

Keycloak is an identity and access management server that handles authentication and authorization for applications. A flaw in its client management component allows an authenticated administrator to inject and execute malicious JavaScript code on the server, potentially compromising the entire system and any other applications or organizations relying on it. Exploitation requires an attacker with delegated client management permissions, but successful exploitation grants complete control over the server.

Technologies: Keycloak, Red Hat build of Keycloak. Vendors: Keycloak, Red Hat.

Quick answers

Is CVE-2026-120984 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120984 being exploited in the wild.
How severe is CVE-2026-120984?: Critical severity, with a CVSS score of 9.1, published 7 November 2026.
Which products and versions are affected?: Red Hat build of Keycloak; Red Hat Single Sign-On; Keycloak Keycloak.
Is there a fix for CVE-2026-120984?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120984 attacked?: It is attacked over the network.
Am I affected by CVE-2026-120984?: Check whether you run Keycloak, Red Hat build of Keycloak or Red Hat Single Sign-On. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute during setup, allowing an authenticated attacker with client management permissions to bypass upload restrictions. The attacker can then upload a malicious JavaScript policy that executes on the server when authorization requests are processed, achieving arbitrary code execution within the application server process and potentially compromising realm boundaries in multi-tenant deployments.

Affected products

Red Hat build of Keycloak
Red Hat Single Sign-On
Keycloak Keycloak

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.