Skip to content
OpenAdvisories
High · 7.2 CVE-2026-17526 EUVD-2026-80854GHSA-j7cq-x5cp-qpcx

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by redhat

Description

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.4 — —
Red Hat Red Hat build of Keycloak 26.4.16 — —
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.7 — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —

Advisories 1

References