PT-2026-34453 · Red Hat+1 · Keycloak+1

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41166

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.22.1

Description A user possessing the write:admin role in one Keycloak realm can utilize the Manager API to update Keycloak realm roles for users in a different realm, including the master realm. The issue exists because the handler uses the {realm} path segment when communicating with the identity provider but fails to verify if the caller has administrative privileges for that specific realm. This flaw is located in the updateUserRealmRoles() function within manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java. An attacker could achieve privilege escalation to a master realm administrator if they control any user within that realm.

Recommendations Update to version 1.22.1.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-41166

GHSA-49VV-25QX-MG44

Affected Products

Keycloak

Openremote

References · 6

• https://osv.dev/vulnerability/GHSA-49vv-25qx-mg44 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41166 · Security Note
• https://github.com/openremote/openremote · Note
• https://github.com/openremote/openremote/releases/tag/1.22.1 · Note
• https://github.com/openremote/openremote/security/advisories/GHSA-49vv-25qx-mg44 · Note
• https://reddit.com/r/VulnMatter/comments/1ssnpas/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post