{"id":"CVE-2026-120984","kind":"vulnerability","aliases":["CVE-2026-120984"],"related":[],"title":"Keycloak: client management rights plus authorization services let an admin run code on the server via inline JavaScript policy","description":"A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.","summary":"When a Keycloak client is created or imported with authorization services enabled, an internal session attribute is not cleared, which lets a user with client management rights upload a malicious JavaScript policy. That policy runs on the server when an authorization request is made, so an attacker can run arbitrary code on the server.","severity":"high","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","other","red-hat-sso","rhbk","self-hosted"],"not_affected_if":["managed-hosting","no-client-management-rights"],"how_to_check":"Affected versions are not published yet. You are exposed if you self-host Keycloak or Red Hat Build of Keycloak / Red Hat SSO 7, use clients with authorization services enabled, and delegate client management (manage-clients) rights to anyone besides full admins. Audit who holds manage-clients and review authorization policies of type JavaScript on existing clients.","fix":null,"status":"open","published_at":"2026-11-07T14:17:01+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","triaged_at":"2026-11-07T14:49:45+00:00","updated_at":"2026-11-07T14:50:43+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-07T14:49:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: client setup flaw lets an authenticated user run server code","impact":"high","summary":"When a Keycloak client is created or imported with authorization services enabled, an internal session attribute is not cleared, which lets a user with client management rights upload a malicious JavaScript policy. That policy runs on the server when an authorization request is made, so an attacker can run arbitrary code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the Keycloak server, compromising the whole system","analyst_note":"Affected and fixed Keycloak versions are not in the sources; check the NVD entry and the Keycloak security advisory for ranges and the fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","no-client-management-rights"],"who_is_affected":"Organizations running Keycloak as a self-hosted identity server where clients are created or imported with authorization services enabled. Exposure needs an account that holds client management permissions, so teams that restrict those rights to a few administrators face less risk. Sources do not list affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00067,"input_tokens":4258,"output_tokens":489,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Affected and fixed Keycloak versions are not in the sources; check the NVD entry and the Keycloak security advisory for ranges and the fixed release.","search":"'-120984':22A,25A '-2026':21A,24A 'admin':10A 'allow':130C,164C 'arbitrari':86B,169C 'attack':83B,133C,166C 'attribut':52B,123C 'authent':132C 'author':6A,46B,77B,111C,157C 'bypass':139C 'clear':55B,119C 'client':2A,40B,61B,100C,105C,135C 'code':12A,87B,170C 'compon':102C 'compromis':175C 'control':141C 'could':163C 'creat':42B,107C 'cve':20A,23A 'enabl':48B,113C 'entir':177C 'execut':151C 'exploit':162C 'fail':116C 'flaw':92C 'found':94C 'hat':31B 'host':36B 'ident':26B 'import':44B,109C 'inlin':17A 'intern':50B,121C 'javascript':18A,67B,146C 'keycloak':1A,27B,39B,97C 'let':8A,57B 'made':80B,160C 'malici':66B,145C 'manag':3A,62B,101C,136C 'permiss':137C 'plus':5A 'polici':19A,68B,70B,147C 'potenti':174C 'process':128C 'proper':118C 'red':30B 'red-hat-sso':29B 'request':78B,158C 'rhbk':33B 'right':4A,63B 'run':11A,71B,85B,168C 'secur':140C 'self':35B 'self-host':34B 'server':15A,74B,90B,98C,154C,173C 'servic':7A,47B,112C 'session':51B,122C 'setup':127C 'sso':32B 'success':161C 'system':115C,178C 'upload':64B,143C 'use':124C 'user':59B 'via':16A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Keycloak, Red Hat Build of Keycloak and Red Hat Single Sign-On 7 (Red Hat lists these as affected, no version ranges yet). Exposure needs an account with delegated client management roles, and clients created or imported with authorization services enabled. Teams where only trusted full admins hold those rights, and managed hosting users, face little risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","identity","keycloak","other","redhatsso","rhbk","selfhosted"],"campaign_type":null,"search_a":"'-120984':22A,25A '-2026':21A,24A 'admin':10A 'author':6A 'client':2A 'code':12A 'cve':20A,23A 'inlin':17A 'javascript':18A 'keycloak':1A 'let':8A 'manag':3A 'plus':5A 'polici':19A 'right':4A 'run':11A 'server':15A 'servic':7A 'via':16A","search_b":"'arbitrari':86B 'attack':83B 'attribut':52B 'author':46B,77B 'clear':55B 'client':40B,61B 'code':87B 'creat':42B 'enabl':48B 'hat':31B 'host':36B 'ident':26B 'import':44B 'intern':50B 'javascript':67B 'keycloak':27B,39B 'let':57B 'made':80B 'malici':66B 'manag':62B 'polici':68B,70B 'red':30B 'red-hat-sso':29B 'request':78B 'rhbk':33B 'right':63B 'run':71B,85B 'self':35B 'self-host':34B 'server':74B,90B 'servic':47B 'session':51B 'sso':32B 'upload':64B 'user':59B","search_c":"'allow':130C,164C 'arbitrari':169C 'attack':133C,166C 'attribut':123C 'authent':132C 'author':111C,157C 'bypass':139C 'clear':119C 'client':100C,105C,135C 'code':170C 'compon':102C 'compromis':175C 'control':141C 'could':163C 'creat':107C 'enabl':113C 'entir':177C 'execut':151C 'exploit':162C 'fail':116C 'flaw':92C 'found':94C 'import':109C 'intern':121C 'javascript':146C 'keycloak':97C 'made':160C 'malici':145C 'manag':101C,136C 'permiss':137C 'polici':147C 'potenti':174C 'process':128C 'proper':118C 'request':158C 'run':168C 'secur':140C 'server':98C,154C,173C 'servic':112C 'session':122C 'setup':127C 'success':161C 'system':115C,178C 'upload':143C 'use':124C","first_public_at":"2026-11-07T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120984","severity":null,"published_at":"2026-11-07T14:17:01+00:00","modified_at":"2026-11-07T14:17:01+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","fetched_at":"2026-11-07T14:47:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120984:2129","url":"https://access.redhat.com/security/cve/CVE-2026-120984","severity":null,"published_at":"2026-11-07T14:50:43+00:00","modified_at":"2026-11-07T14:50:43+00:00","first_seen_at":"2026-11-07T14:50:43+00:00","fetched_at":"2026-11-07T14:50:43+00:00","note":"Red Hat CVE page (primary for its products) rates Important (not Critical: needs elevated delegated client-management roles), lists Keycloak/RHBK/RHSSO7 affected, says no mitigation available, no versions or fixed release published. Upstream Keycloak advisory not found. Severity lowered critical->high per Red Hat's own Important rating. Nothing verified. X not checked.","cites":["https://access.redhat.com/security/cve/CVE-2026-120984"]}],"documents":[{"id":96184,"url":"https://access.redhat.com/security/cve/CVE-2026-120984","title":"Red Hat: CVE-2026-120984","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}