How do I check whether I am affected by CVE-2026-4628?

Check whether any realm client's UMA resource server sets allowRemoteResourceManagement to false and whether the UMA resource_set endpoint is in use. Check the running Keycloak version against maven org.keycloak:keycloak-services <= 26.6.0.

What is the fix for CVE-2026-4628?

Upgrade to a Keycloak release newer than 26.6.0; the fixed version is unknown from the sources.

Who is not affected by CVE-2026-4628?

Not affected if: remote-resource-management-not-restricted, uma-not-used.

Live › vulnerability › CVE-2026-4628

Go to dashboard

medium4.3Runtimemaven

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Q: What is the fix for CVE-2026-4628?

Upgrade to a Keycloak release newer than 26.6.0; the fixed version is unknown from the sources.

Q: Who is not affected by CVE-2026-4628?

Not affected if: remote-resource-management-not-restricted, uma-not-used.

Keycloak's User-Managed Access resource_set endpoint does not fully enforce the allowRemoteResourceManagement=false restriction on PUT requests. An attacker with valid credentials can modify protected resources, which affects data integrity.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by GitHub

known so far6 of 6

First public: Mar 23, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: Not known from the sources.
Worst case: Authenticated attacker modifies protected UMA resources despite remote management restriction.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-4628

Go to dashboard

medium4.3Runtimemaven

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by GitHub

known so far6 of 6

First public: Mar 23, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Yes.
Reachable from: Not known from the sources.
Worst case: Authenticated attacker modifies protected UMA resources despite remote management restriction.
CVSS said: 4.3. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

2 products

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
org.keycloak:keycloak-services	maven	<= 26.6.0	–
redhat build of keycloak	vendor	–	–

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources