Keycloak CVE-2026-9795: Brief Summary of FGAPv2 Privilege Escalation via Scope Mapping Bypass

Introduction

Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) feature is missing an authorization check. A delegated administrator with limited client management permissions can use that gap to inject arbitrary realm roles, including realm-admin, into a client's scope mapping. The result is poisoned authentication tokens for downstream users. This is the second privilege escalation vulnerability found in FGAPv2 since the feature arrived in Keycloak 26.2.0 just one year ago, which raises questions about how mature the permission enforcement model is in one of the most widely deployed open-source IAM platforms.

Keycloak is an open-source identity and access management solution that provides single sign-on, social login, user federation, and standards-based authentication for modern applications. Red Hat (an IBM subsidiary) distributes it commercially as the "Red Hat build of Keycloak," and it is the identity backbone for enterprise environments across the $22+ billion IAM market. OpenCVE records 114 CVEs for Keycloak, which makes it a significant and persistent attack surface for organizations that rely on it for centralized authentication.

Technical Information

Root Cause

CVE-2026-9795 is in the Keycloak admin REST API, in the org.keycloak.services.resources.admin component. The ScopeMappedResource and ScopeMappedClientResource write endpoints, which add and delete scope mappings for clients, do not invoke the requireMapClientScope authorization check on a per-role basis. As a result, the API never verifies that the requesting administrator holds the MAP_ROLE_CLIENT_SCOPE permission before it adds a realm role to a client's scope mapping.

The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), which describes a weakness where "a product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor." Here, the missing check creates exactly that sphere of control. Any administrator with fine-grained manage permission on a single client can change scope mappings to include roles they should never be able to assign.

CVSS Vector Analysis

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N, and the score is 7.3 (High).

The Scope:Changed metric matters most here. The impact extends from the client-level boundary into the realm-level boundary, so a small code defect in scope mapping enforcement produces a large blast radius across the entire Keycloak realm.

Attack Flow

Three conditions must come together for exploitation to succeed:

Step 1: FGAPv2 must be enabled. The target realm must have adminPermissionsEnabled=true. Keycloak 26.2.0 (May 2025) introduced this feature, which provides fine-grained delegated administration.

Step 2: The attacker must hold fine-grained manage permission on at least one client. The attacker needs neither global manage-clients permission nor MAP_ROLE_CLIENT_SCOPE permission on any privileged role. A narrow, delegated permission on a single client is enough.

Step 3: The attacker injects a privileged role into the client's scope mapping. The attacker calls:

POST /admin/realms/{realm}/clients/{uuid}/scope-mappings/realm

with the realm-admin role (or any other highly privileged role) in the request body. Because the requireMapClientScope check is missing, the request succeeds even though the attacker lacks the necessary permissions.

Step 4 (optional): The attacker enables full scope. The attacker can set fullScopeAllowed=true on the client via:

PUT /admin/realms/{realm}/clients/{uuid}

Step 5: Token poisoning occurs. When a user who holds the targeted role (e.g., realm-admin) authenticates through the modified client, the injected role is projected into the issued authentication token. The attacker gains no privileges directly. They poison the token issuance pipeline, and the authenticating user receives unintended scope within that client session.

This indirect exploitation model is why the CVSS vector has User Interaction:Required. The attacker sets the trap, but a privileged user must walk into it by authenticating through the compromised client.

Architectural Implications

The mismatch between the narrow root cause (a missing requireMapClientScope call) and the broad impact (realm-level privilege escalation via token poisoning) is characteristic of IAM platform vulnerabilities. The flaw turns the scope mapping mechanism into a privilege injection vector. A lower-privileged actor can influence the tokens issued to higher-privileged actors without compromising their accounts directly.

This is also the second documented privilege escalation in FGAPv2. CVE-2025-7784 (CVSS 7.1 High) addressed a similar admin console privilege escalation when FGAPv2 was enabled, in which a user with limited permissions could improperly access restricted administrative functionality. Two privilege escalation flaws in the same feature suggest a systemic weakness in the permission enforcement model, one that warrants architectural review rather than point fixes.

Affected Systems and Versions

Based on the available information, these configurations are affected:

• Keycloak instances with FGAPv2 enabled (adminPermissionsEnabled=true on the realm)
• FGAPv2 was introduced in Keycloak 26.2.0 (May 2025), so versions from 26.2.0 onward are potentially vulnerable when the feature is enabled
• The most recent release, Keycloak 26.6.2 (May 19, 2026), does not include a fix for CVE-2026-9795
• Red Hat build of Keycloak distributions are also affected when FGAPv2 is enabled

The vulnerability cannot be exploited if FGAPv2 is not enabled on the realm, or if no delegated administrator holds fine-grained manage permission on any client. Organizations that have not enabled FGAPv2 are not affected.

No patched version has been identified. The Red Hat Bugzilla entry's "Fixed In Version" field remains empty as of 2026-05-28.

Vendor Security History

OpenCVE lists 114 CVEs for Keycloak, which points to a persistent attack surface in the IAM platform. Recent high-severity Keycloak CVEs span a wide range of vulnerability types:

FGAPv2 alone has produced two privilege escalation CVEs (CVE-2025-7784 and CVE-2026-9795) within about a year of its introduction. That pattern suggests the feature's permission enforcement model is not yet mature. Organizations should treat FGAPv2 as carrying elevated risk until it goes a sustained period without new privilege escalation findings.

Red Hat's security response process, coordinated through [email protected] and the Red Hat Bugzilla system, has consistently acknowledged and tracked these issues. Recent advisories include RHSA-2026:19596 (Red Hat build of Keycloak 26.4.12) and RHSA-2026:6478, though neither addresses CVE-2026-9795.

No recent Keycloak CVEs have been observed as actively exploited in the wild, and none appear in the CISA Known Exploited Vulnerabilities catalog.

References

• NVD: CVE-2026-9795
• Red Hat Security CVE Page: CVE-2026-9795
• Red Hat Bugzilla: Bug 2482462
• GitHub Security Advisory GHSA-27gp-8389-hm4w: CVE-2025-7784 FGAPv2 Privilege Escalation
• NVD: CVE-2025-7784
• Red Hat Bugzilla: Bug 2381861 (CVE-2025-7784)
• Keycloak Blog: Achieving Fine-Grained Admin Permissions (FGAPv2)
• CWE-266: Incorrect Privilege Assignment
• Keycloak 26.6.2 Release Notes
• OpenCVE: Keycloak CVEs
• Keycloak GitHub Releases
• Keycloak Server Administration Guide
• RHSA-2026:19596 Security Advisory
• RHSA-2026:6478 Security Advisory
• Mondoo: 2026 State of Vulnerabilities Report