Is CVE-2026-4636 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4636 being exploited in the wild.

How severe is CVE-2026-4636?

High severity, with a CVSS score of 8.1, published 2 April 2026.

Which products and versions are affected?

org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,fixed=26.5.7; Red Hat build of Keycloak Fixed in 26.2.15-1.

Is there a fix for CVE-2026-4636?

Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4636 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4636?

Check whether you run org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4636: Keycloak UMA policy bypass in Protection API

CVE-2026-4636 · Severity: high · CVSS 8.1 · Published 2026-04-02

Keycloak is an identity and access management solution used to secure applications and services. A security flaw allows certain authenticated users to bypass protection policies and gain unauthorized access to resources owned by other users. This could lead to the exposure of sensitive information or the performance of unauthorized actions on behalf of other users.

Technologies: org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-4636 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4636 being exploited in the wild.
How severe is CVE-2026-4636?: High severity, with a CVSS score of 8.1, published 2 April 2026.
Which products and versions are affected?: org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=0,fixed=26.5.7; Red Hat build of Keycloak Fixed in 26.2.15-1.
Is there a fix for CVE-2026-4636?: Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4636 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4636?: Check whether you run org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.keycloak:keycloak-services (Maven): upgrade to 26.5.7 or later

# set org.keycloak:keycloak-services to 26.5.7 in your pom.xml or build.gradle

Technical details

A vulnerability in Keycloak's User-Managed Access (UMA) implementation allows an authenticated user with the 'uma_protection' role to bypass policy validation. The flaw exists because the application fails to properly validate resource identifiers within a policy creation request against the resource specified in the URL path. An attacker can include resource IDs belonging to other users in a request targeting their own resource, effectively granting themselves unauthorized permissions. This enables the attacker to obtain a Requesting Party Token (RPT) for victim-owned resources. The issue is classified as CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization) and has been addressed in Red Hat build of Keycloak versions 26.2.15 and 26.4.11.

Affected products

Red Hat Red Hat build of Keycloak 26.2 Fixed in 26.2.15-1
Red Hat Red Hat build of Keycloak 26.4 Fixed in 26.4.11-1

Identifiers

CVE-2026-4636
GHSA-f2hx-5fx3-hmcv

Timeline

2026-04-02: disclosed
2026-04-02: patched: Fixed in Red Hat build of Keycloak 26.2.15 and 26.4.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.