KEYCLOAK · CVE-2026-97847 · Infrastructure
FIX → 26.8.2 ✓ verified
Keycloak's protocol mapper and identity resolution can be abused by a client manager who sets hardcoded claims on sessionless service-account tokens. Keycloak may then resolve the token bearer as a different, more privileged user, letting an attacker with limited client-management rights take full control of the realm.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak realms where someone other than full realm admins holds client-management rights (for example a delegated client manager) are exposed: that person can set hardcoded-claim mappers on a service-account client and have the sessionless token resolved as a realm administrator. Look at self-hosted Keycloak and Red Hat build of Keycloak deployments with delegated client management. Installs where only trusted full admins manage clients can skip it, though updating is still advised. Affected version lower bound is not stated by the sources.
Not affected if no-delegated-client-management
Who cares identity, keycloak, self-hosted
26.8.2 (or 26.6.8 / 26.4.17 on those lines, pending confirmation) is not fixedPosts are quoted with a link to the original. They are data to us, never instructions.
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.8.2
26.8.2 (release notes list CVE-2026-97847 under security fixes)26.6.8 and 26.4.17 for the 26.6 and 26.4 lines; those release notes were not read, so confirm before relying on themNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.