Is CVE-2026-4629 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4629 being exploited in the wild.

How severe is CVE-2026-4629?

Medium severity, with a CVSS score of 6.5, published 30 June 2026.

Which products and versions are affected?

Keycloak Keycloak; Red Hat Red Hat Build of Keycloak.

Is there a fix for CVE-2026-4629?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4629 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4629?

Check whether you run Keycloak or Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4629: Keycloak privilege escalation via hardcoded role mapper injection

CVE-2026-4629 · Severity: medium · CVSS 6.5 · Published 2026-06-30

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A vulnerability allows a user who already has permission to manage clients to grant themselves full administrative control over the entire security realm. This could lead to an attacker gaining complete access to user data, security configurations, and the ability to modify authentication policies across the organization.

Technologies: Keycloak, Red Hat build of Keycloak. Vendors: Keycloak, Red Hat.

Quick answers

Is CVE-2026-4629 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4629 being exploited in the wild.
How severe is CVE-2026-4629?: Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?: Keycloak Keycloak; Red Hat Red Hat Build of Keycloak.
Is there a fix for CVE-2026-4629?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4629 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4629?: Check whether you run Keycloak or Red Hat build of Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw in Keycloak's role mapping logic allows a highly privileged user with the `manage-clients` permission to escalate their privileges to `realm-admin`. By injecting an `oidc-hardcoded-role-mapper` into a client configuration and setting it to the `realm-management.realm-admin` role, the attacker can bypass existing scope restrictions (such as `fullScopeAllowed: false`). When authenticating through the modified client, the generated token includes the injected administrative role, granting the attacker full access to the realm's administrative APIs. This is classified as Incorrect Privilege Assignment (CWE-266).

Affected products

Keycloak Keycloak
Red Hat Red Hat Build of Keycloak

Timeline

2026-03-23: other: Bug reported in Red Hat Bugzilla
2026-06-30: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.