Quick answers
- Is CVE-2026-9797 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9797 being exploited in the wild.
- How severe is CVE-2026-9797?
- Medium severity, with a CVSS score of 6.5, published 6 November 2026.
- Which products and versions are affected?
- Red Hat Keycloak.
- Is there a fix for CVE-2026-9797?
- No fixed version is recorded yet. Red Hat indicates that no practical mitigation is currently available. Upgrade to a patched version of Keycloak when available, or consider restricting administrative role assignments until a fix is deployed. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9797 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-9797?
- Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Red Hat indicates that no practical mitigation is currently available. Upgrade to a patched version of Keycloak when available, or consider restricting administrative role assignments until a fix is deployed.
Technical details
A privilege escalation flaw exists in Keycloak's administrative services that permits authenticated users with the 'manage-clients' role to escalate to 'realm-admin' privileges. The vulnerability is rooted in incorrect privilege assignment (CWE-266) and can be exploited by manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types, resetting secrets, or downloading signing keys. An attacker must have valid authentication with the manage-clients role and network access to the administrative API; successful exploitation grants realm-admin role assignments.
Affected products
- Red Hat Keycloak
Timeline
- 2026-11-06: disclosed