CVE-2026-116468 · Runtime
NO FIX YET
A delegated administrator of Keycloak can move a group they control under an administrative group, so every member of the moved group inherits full realm-admin privileges. The attacker then gets complete control over the realm.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running Red Hat build of Keycloak or Keycloak where delegated administrators can manage groups or organization group hierarchies. Realms that do not delegate group management to non-full admins are less exposed. The sources do not name affected versions.
Not affected if no-delegated-group-admins
Who cares keycloak, self-hosted, sso
No fix yet, per the sources.
A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.