Vulnerability in Red Hat Build of Keycloak

[ Description ]Official description

A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3577

  Keycloak: Vulnerability allows gaining administrator rights Translated from German

  CVE-2026-107121CVE-2026-96448

[ References ]References

• access.redhat.com/security/cve/CVE-2026-96448
• bugzilla.redhat.com/show_bug.cgi