PT-2026-28426 · Red Hat · Keycloak

Osidb Bzimport · CVE-2026-3121 · Published 2026-03-26 · Updated 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak where an administrator possessing manage-clients permission can exploit a misconfiguration. This misconfiguration arises when the manage-clients permission is equivalent to manage-permissions, enabling the administrator to escalate privileges. This privilege escalation allows gaining control over roles, users, or other administrative functions within the realm. The issue occurs when administrator permissions are enabled at the realm level. The vulnerable permission is manage-clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-3121

GHSA-7XF9-4JFC-WGM4

Affected Products

Keycloak

References · 10

• https://access.redhat.com/errata/RHSA-2026:6477 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2442277 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:6478 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-3121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3121 · Security Note
• https://osv.dev/vulnerability/GHSA-7xf9-4jfc-wgm4 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/79ab3110a257fb8d6f1a664c916687128094ed01 · Note
• https://github.com/keycloak/keycloak/issues/46719 · Note
• https://twitter.com/CVEnew/status/2037280583911674186 · Twitter Post