---
id: "CVE-2026-120984"
page: "https://infrastack.ai/live/CVE-2026-120984"
kind: "vulnerability"
aliases: ["CVE-2026-120984"]
title: "Keycloak: client management rights plus authorization services let an admin run code on the server via inline JavaScript policy"
severity: "high"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["identity", "keycloak", "other", "red-hat-sso", "rhbk", "self-hosted"]
not_affected_if: ["managed-hosting", "no-client-management-rights"]
published_at: "2026-11-07T14:17:01+00:00"
first_seen_at: "2026-11-07T14:47:39+00:00"
updated_at: "2026-11-07T14:50:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120984", "first_seen_at": "2026-11-07T14:47:39+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-120984", "first_seen_at": "2026-11-07T14:50:43+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-120984"]}]
exploit_sources: []
---

# Keycloak: client management rights plus authorization services let an admin run code on the server via inline JavaScript policy

Link for people: https://infrastack.ai/live/CVE-2026-120984 (this .md is for agents)

When a Keycloak client is created or imported with authorization services enabled, an internal session attribute is not cleared, which lets a user with client management rights upload a malicious JavaScript policy. That policy runs on the server when an authorization request is made, so an attacker can run arbitrary code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Affected versions are not published yet. You are exposed if you self-host Keycloak or Red Hat Build of Keycloak / Red Hat SSO 7, use clients with authorization services enabled, and delegate client management (manage-clients) rights to anyone besides full admins. Audit who holds manage-clients and review authorization policies of type JavaScript on existing clients.

## Timeline

- 2026-11-07T14:47:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120984
- 2026-11-07T14:50:43+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-120984 — Red Hat CVE page (primary for its products) rates Important (not Critical: needs elevated delegated client-management roles), lists Keycloak/RHBK/RHSSO7 affected, says no mitigation available, no versions or fixed release published. Upstream Keycloak advisory not found. Severity lowered critical->high per Red Hat's own Important rating. Nothing verified. X not checked.

## Documents

- [advisory] Red Hat: CVE-2026-120984 https://access.redhat.com/security/cve/CVE-2026-120984

## From the sources

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_