Attack Chain

1. Attacker obtains valid credentials for a Keycloak account assigned the manage-users role.
2. Attacker enumerates available roles via the .../role-mappings/.../available endpoint, which is accessible to manage-users users.
3. Attacker identifies a composite role (or creates one if existing roles permit) that wraps realm-management/realm-admin as a child.
4. Attacker performs a POST request to addRealmRoleMappings or addClientRoleMapping to assign this composite role to a target user, group, or client.
5. The Keycloak server fails to recursively inspect the nested children of the role and validates only the top-level role name.
6. The target user, group, or client gains effective realm-admin permissions, allowing for further malicious activity such as creating new roles or accessing confidential information.

Impact

Successful exploitation allows a user with restricted manage-users privileges to gain full realm-admin access. This facilitates complete control over the realm, including user management, configuration of clients, and access to sensitive information, effectively bypassing the principle of least privilege.

Recommendation

• Update all Keycloak instances to a version where CVE-2026-94000 is patched.
• Implement a policy to restrict the ability of manage-users to perform role-mapping operations if not strictly required for business operations.
• Audit existing role-mapping assignments for composite roles that may grant elevated administrative permissions to unauthorized users.
• Monitor logs for unusual POST requests to role mapping endpoints by users holding the manage-users role.