CVE-2026-9796
Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability
- State
- Published
- Severity
- 6.5 Medium
- Published
- May 28, 2026
- Updated
- Sep 15, 2026
- Reserved
- May 28, 2026
Description
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | redhat |
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6.6Red Hat | |
Red Hat Build of KeycloakRed Hat |
References
- RHSA-2026:56523vendor-advisory
- RHSA-2026:56524vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-9796vdb-entry
- RHBZ#2482464issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.