Executive brief
Keycloak, a popular open-source identity and access management tool, is vulnerable to a privilege escalation flaw. An attacker who already has limited administrative permissions (specifically the 'manage-clients' role) can exploit a timing and naming flaw to grant themselves full 'realm-admin' control. This allows the attacker to take over all user accounts and settings within that realm, and these elevated permissions remain active even after a system reboot or if the attacker's original access is revoked.
Technical details
A Time-of-check Time-of-use (TOCTOU) vulnerability exists in Keycloak's name-based admin role checks. The guards preventing admin role assignment rely on role names, but the role rename endpoint fails to validate against these protected names. Because composite role relationships are stored by entity ID rather than name, an attacker with 'manage-clients' permissions can rename a protected role to bypass the name-based guard, add it as a composite child of another role, and then rename it back. This results in a persistent privilege escalation to 'realm-admin' that survives reboots and permission revocation. The issue is addressed in Keycloak version 26.6.4 by blocking updates on the realm-management client and improving role protection logic.
Affected products
- Keycloak Keycloak Server < 26.6.4
- Red Hat Red Hat Build of Keycloak -
Timeline
- 2026-05-28: disclosed: Initial disclosure and NVD publication
- 2026-06-10: patched: Fix merged into main branch via PR #49624
- 2026-07-01: advisory: GitHub Advisory reviewed and updated