Is CVE-2026-16106 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16106 being exploited in the wild.

How severe is CVE-2026-16106?

Medium severity, with a CVSS score of 4.9, published 17 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak unspecified.

Is there a fix for CVE-2026-16106?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16106 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-16106?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16106: Keycloak missing authorization in admin REST API role management

CVE-2026-16106 · Severity: medium · CVSS 4.9 · Published 2026-07-17

A security flaw was found in Keycloak, an identity and access management system used to secure applications and manage user credentials. A user with limited administrative access can remove high-level security roles from the system that they should not be allowed to modify. This could allow a malicious insider to strip other administrators of their access or disrupt critical security configurations across the organization.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-16106 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16106 being exploited in the wild.
How severe is CVE-2026-16106?: Medium severity, with a CVSS score of 4.9, published 17 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-16106?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16106 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-16106?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check exists in the Keycloak admin REST API endpoints responsible for removing child roles from composite roles (specifically the DELETE /admin/realms/{realm}/roles-by-id/{role-id}/composites and DELETE /admin/realms/{realm}/roles/{role-name}/composites endpoints). While the API verifies if the caller has 'manage' permissions on the parent role container, it fails to perform per-child role authorization checks. An attacker with delegated administrative permissions can exploit this to remove privileged child roles (such as realm-admin) from existing composites. This results in the removal of those roles from all users or groups assigned to the composite, leading to unauthorized privilege modification or denial of service for other administrators.

Affected products

Red Hat Red Hat Build of Keycloak unspecified

Timeline

2026-07-17: disclosed
2026-07-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.