PT-2026-28426 · Red Hat · Keycloak

Osidb Bzimport · CVE-2026-3121 · Publicado 2026-03-26 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak where an administrator possessing manage-clients permission can exploit a misconfiguration. This misconfiguration arises when the manage-clients permission is equivalent to manage-permissions, enabling the administrator to escalate privileges. This privilege escalation allows gaining control over roles, users, or other administrative functions within the realm. The issue occurs when administrator permissions are enabled at the realm level. The vulnerable permission is manage-clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-266

Identificadores relacionados

CVE-2026-3121

GHSA-7XF9-4JFC-WGM4

Produtos afetados

Keycloak

Referências · 10

• https://github.com/keycloak/keycloak · Nota
• https://github.com/keycloak/keycloak/commit/79ab3110a257fb8d6f1a664c916687128094ed01 · Nota
• https://github.com/keycloak/keycloak/issues/46719 · Nota
• https://access.redhat.com/errata/RHSA-2026:6477 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2442277 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2026:6478 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2026-3121 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280583911674186 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3121 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7xf9-4jfc-wgm4 · Aviso do Fabricante