{"id":"CVE-2026-97847","kind":"vulnerability","aliases":["CVE-2026-97847"],"related":[],"title":"Keycloak: hardcoded claim mappers let a client manager impersonate realm admin","description":"A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.","summary":"Keycloak's protocol mapper and identity resolution can be abused by a client manager who sets hardcoded claims on sessionless service-account tokens. Keycloak may then resolve the token bearer as a different, more privileged user, letting an attacker with limited client-management rights take full control of the realm.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":["26.8.2"],"affected":"< 26.8.2 (lower bound unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["identity","infrastructure","keycloak","self-hosted"],"not_affected_if":["no-delegated-client-management"],"how_to_check":"Check your Keycloak version (Admin console > server info, or bin/kc.sh --version). Below 26.8.2 (or 26.6.8 / 26.4.17 on those lines, pending confirmation) is not fixed. Then list who holds manage-clients or client-management rights in each realm (including delegated/fine-grained admin permissions) and review service-account clients for hardcoded-claim protocol mappers that set sub, preferred_username or similar identity claims. Affected lower bound is not stated by any source read.","fix":"Upgrade Keycloak to 26.8.2 (release notes list CVE-2026-97847 under security fixes). The project's issue #54697 also carries release labels 26.6.8 and 26.4.17 for the 26.6 and 26.4 lines; those release notes were not read, so confirm before relying on them. Red Hat builds (rhbk): check Red Hat's advisory, no fixed build was listed on its CVE page.","status":"open","published_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:34+00:00","updated_at":"2026-11-05T18:41:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T18:40:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: hardcoded claim mappers let a client manager impersonate realm admin","impact":"high","summary":"Keycloak's protocol mapper and identity resolution can be abused by a client manager who sets hardcoded claims on sessionless service-account tokens. Keycloak may then resolve the token bearer as a different, more privileged user, letting an attacker with limited client-management rights take full control of the realm.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker becomes realm administrator and gains full control of the realm","analyst_note":"Find the NVD entry's affected version ranges and whether a fixed Keycloak release exists; the sources given name neither.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-delegated-client-management"],"who_is_affected":"Deployments of Keycloak that let some users manage clients and use hardcoded-claim protocol mappers on service-account tokens are the exposed ones. The sources do not name affected version ranges or the default configuration, so whether a given install is exposed is unknown. Installs that do not delegate client management to anyone are unlikely to be reachable through this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4273,"output_tokens":512,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NVD entry's affected version ranges and whether a fixed Keycloak release exists; the sources given name neither.","search":"'-2026':13A,16A '-97847':14A,17A 'abus':34B 'account':47B,111C 'admin':11A 'administr':152C 'allow':140C 'attack':64B,142C 'base':133C 'bearer':55B,126C 'claim':3A,42B,101C,106C,137C 'client':7A,37B,68B,96C,145C 'client-manag':67B 'compon':88C 'control':73B,156C 'cve':12A,15A 'differ':58B,129C 'flaw':78C 'found':80C 'full':72B,155C 'gain':154C 'hardcod':2A,41B,100C 'hardcoded-claim':99C 'high':130C 'host':24B 'id':119C 'ident':19B,30B,86C,105C 'imperson':9A,149C 'incorrect':122C 'infrastructur':20B 'issu':92C 'keycloak':1A,18A,21B,25B,49B,90C,120C 'lack':116C 'let':5A,62B 'limit':66B,144C 'manag':8A,38B,69B,97C,146C 'manipul':136C 'mapper':4A,28B,84C,102C 'may':50B,121C 'occur':93C 'overrid':104C 'permiss':147C 'privileg':60B,131C 'protocol':27B,83C 'realm':10A,76B,151C,159C 'resolut':31B,87C 'resolv':52B,123C 'right':70B 'self':23B 'self-host':22B 'servic':46B,110C 'service-account':45B,109C 'session':118C 'sessionless':44B,108C 'set':40B 'take':71B 'token':48B,54B,112C,115C,125C 'use':98C 'user':61B,132C","nicknames":[],"mitigations":[],"who_affected":"Keycloak realms where someone other than full realm admins holds client-management rights (for example a delegated client manager) are exposed: that person can set hardcoded-claim mappers on a service-account client and have the sessionless token resolved as a realm administrator. Look at self-hosted Keycloak and Red Hat build of Keycloak deployments with delegated client management. Installs where only trusted full admins manage clients can skip it, though updating is still advised. Affected version lower bound is not stated by the sources.","tier":"B","verified":{"fix":{"at":"2026-11-05T18:41:37Z","by":"analyst","doc":"https://github.com/keycloak/keycloak/issues/54697","run_id":1813}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["keycloak"],"ptokens":["keycloak"],"labels":["high","identity","infrastructure","keycloak","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97847","severity":null,"published_at":"2026-11-05T18:17:11+00:00","modified_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97847:1813","url":"https://www.keycloak.org/2026/11/keycloak-2682-released","severity":null,"published_at":"2026-11-05T18:41:37+00:00","modified_at":"2026-11-05T18:41:37+00:00","first_seen_at":"2026-11-05T18:41:37+00:00","fetched_at":"2026-11-05T18:41:37+00:00","note":"Keycloak 26.8.2 release notes and issue #54697 (labels 26.8.2, 26.6.8, 26.4.17) name the fix; Red Hat rates Important, no mitigation, exploitation needs client-management rights and knowledge of admin identifiers. Affected lower bound unknown; backport versions from issue labels only. No exploitation or PoC found. X not searched. NVD page returned empty.","cites":["https://www.keycloak.org/2026/11/keycloak-2682-released","https://github.com/keycloak/keycloak/issues/54697","https://access.redhat.com/security/cve/CVE-2026-97847"]}],"documents":[{"id":78345,"url":"https://www.keycloak.org/2026/11/keycloak-2682-released","title":"Keycloak 26.8.2 released","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":78830,"url":"https://github.com/keycloak/keycloak/issues/54697","title":"[CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78831,"url":"https://access.redhat.com/security/cve/CVE-2026-97847","title":"Red Hat CVE-2026-97847","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}