PT-2026-44187 · Red Hat · Keycloak

Daniel Peters + 2 · Published 2026-05-28 · Updated 2026-06-03 · CVE-2026-9796

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authenticated administrator possessing the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) flaw in name-based admin role checks. TOCTOU is a race condition where a system checks a condition and then uses the result of that check, but the condition changes between the check and the use. This allows an attacker to escalate privileges to realm-admin for all users within the realm, providing extensive system control. The composite role relationship remains active even after the attacker's permissions are revoked or the system is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-9796

GHSA-PQ65-77RC-7R8C

Affected Products

Keycloak

References · 9

• https://bugzilla.redhat.com/show_bug.cgi?id=2482464 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-9796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9796 · Security Note
• https://osv.dev/vulnerability/GHSA-pq65-77rc-7r8c · Vendor Advisory
• https://github.com/keycloak/keycloak/issues/49427 · Note
• https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934 · Note
• https://github.com/keycloak/keycloak/pull/49624 · Note
• https://github.com/keycloak/keycloak · Note
• https://twitter.com/dailycve/status/2062317445608558844 · Twitter Post