CVE-2026-9797 · Runtime
NO FIX YET
A user holding the manage-clients role in Keycloak's admin services can change client signing keys, authenticator types or secrets. That lets them obtain a token carrying realm-admin rights, which is a privilege escalation.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak deployments where some accounts hold the manage-clients role, since that role is the required starting point. Deployments where only fully trusted administrators have client-management rights carry less practical risk. The sources do not list affected version ranges.
Not affected if managed-hosting, no-manage-clients-holders
Who cares identity, keycloak, self-hosted
kc.sh --version or the admin console footer; compare against the fixed versions in the NVD entrymanage-clients in each realm and review whether they should have itNo fix yet, per the sources.
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.