{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/secfathy/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["SecFathy"],"_cs_cpes":["cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.6,"id":"CVE-2026-94000"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Keycloak (\u003c= 26.8.1)"],"_cs_severities":["low"],"_cs_tags":["privilege-escalation","keycloak","authentication-bypass"],"_cs_type":"threat","_cs_vendors":["Keycloak"],"content_html":"\u003cp\u003eKeycloak up to version 26.8.1 contains a privilege escalation vulnerability (CVE-2026-94000) within its admin REST API. While Keycloak previously hardened \u0026quot;group join\u0026quot; operations to check for nested admin roles, the role-mapping endpoints (\u003ccode\u003eRoleMapperResource.addRealmRoleMappings\u003c/code\u003e and \u003ccode\u003eClientRoleMappingsResource.addClientRoleMapping\u003c/code\u003e) do not recursively walk the children of a composite role. Consequently, an attacker holding only the \u003ccode\u003emanage-users\u003c/code\u003e role can map a composite role that transitively grants \u003ccode\u003erealm-management/realm-admin\u003c/code\u003e privileges, effectively escalating their own account or other users/groups to \u003ccode\u003erealm-admin\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid credentials for a Keycloak account assigned the \u003ccode\u003emanage-users\u003c/code\u003e role.\u003c/li\u003e\n\u003cli\u003eAttacker enumerates available roles via the \u003ccode\u003e.../role-mappings/.../available\u003c/code\u003e endpoint, which is accessible to \u003ccode\u003emanage-users\u003c/code\u003e users.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a composite role (or creates one if existing roles permit) that wraps \u003ccode\u003erealm-management/realm-admin\u003c/code\u003e as a child.\u003c/li\u003e\n\u003cli\u003eAttacker performs a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003eaddRealmRoleMappings\u003c/code\u003e or \u003ccode\u003eaddClientRoleMapping\u003c/code\u003e to assign this composite role to a target user, group, or client.\u003c/li\u003e\n\u003cli\u003eThe Keycloak server fails to recursively inspect the nested children of the role and validates only the top-level role name.\u003c/li\u003e\n\u003cli\u003eThe target user, group, or client gains effective \u003ccode\u003erealm-admin\u003c/code\u003e permissions, allowing for further malicious activity such as creating new roles or accessing confidential information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a user with restricted \u003ccode\u003emanage-users\u003c/code\u003e privileges to gain full \u003ccode\u003erealm-admin\u003c/code\u003e access. This facilitates complete control over the realm, including user management, configuration of clients, and access to sensitive information, effectively bypassing the principle of least privilege.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Keycloak instances to a version where CVE-2026-94000 is patched.\u003c/li\u003e\n\u003cli\u003eImplement a policy to restrict the ability of \u003ccode\u003emanage-users\u003c/code\u003e to perform role-mapping operations if not strictly required for business operations.\u003c/li\u003e\n\u003cli\u003eAudit existing role-mapping assignments for composite roles that may grant elevated administrative permissions to unauthorized users.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unusual \u003ccode\u003ePOST\u003c/code\u003e requests to role mapping endpoints by users holding the \u003ccode\u003emanage-users\u003c/code\u003e role.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T11:47:21Z","date_published":"2026-10-22T11:47:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-keycloak-privilege-escalation/","summary":"Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with \"manage-users\" permissions can assign composite roles containing \"realm-admin\" privileges due to incomplete authorization checks.","title":"Keycloak: Privilege escalation in admin REST API (CVE-2026-94000)","url":"https://feed.craftedsignal.io/briefs/2026-10-keycloak-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - SecFathy","version":"https://jsonfeed.org/version/1.1"}