{"id":"CVE-2026-9797","kind":"vulnerability","aliases":["CVE-2026-9797"],"related":[],"title":"Keycloak: manage-clients role can escalate to realm-admin tokens","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","summary":"A user holding the manage-clients role in Keycloak's admin services can change client signing keys, authenticator types or secrets. That lets them obtain a token carrying realm-admin rights, which is a privilege escalation.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-manage-clients-holders"],"how_to_check":"- Check the Keycloak version with `kc.sh --version` or the admin console footer; compare against the fixed versions in the NVD entry\n- List users and roles holding `manage-clients` in each realm and review whether they should have it","fix":null,"status":"open","published_at":"2026-11-06T07:18:06+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","triaged_at":"2026-11-06T07:41:51+00:00","updated_at":"2026-11-06T07:41:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T07:41:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: manage-clients role can escalate to realm-admin tokens","impact":"high","summary":"A user holding the manage-clients role in Keycloak's admin services can change client signing keys, authenticator types or secrets. That lets them obtain a token carrying realm-admin rights, which is a privilege escalation.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gets realm-admin token and privilege escalation","analyst_note":"Confirm affected and fixed Keycloak versions from the NVD entry or the Keycloak security advisory; sources given do not list product ranges.","how_to_check":"- Check the Keycloak version with `kc.sh --version` or the admin console footer; compare against the fixed versions in the NVD entry\n- List users and roles holding `manage-clients` in each realm and review whether they should have it\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-manage-clients-holders","managed-hosting"],"who_is_affected":"Keycloak deployments where some accounts hold the manage-clients role, since that role is the required starting point. Deployments where only fully trusted administrators have client-management rights carry less practical risk. The sources do not list affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000696,"input_tokens":4306,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-9797':15A,18A 'access':133C 'admin':11A,36B,56B,123C 'administr':70C 'allow':113C 'assign':125C 'attack':76C,115C 'authent':43B,77C,101C 'carri':53B 'chang':39B 'client':4A,31B,40B,82C,93C,100C 'could':84C 'cve':13A,16A 'download':107C 'escal':7A,62B,129C 'exploit':85C,112C 'flaw':64C 'found':66C 'high':74C 'hold':27B 'host':24B 'ident':19B 'includ':91C 'json':94C 'jwks':98C 'key':42B,96C,110C 'keycloak':1A,20B,34B,68C 'lead':126C 'legitim':108C 'let':48B 'manag':3A,30B,81C 'manage-cli':2A,29B,80C 'manipul':92C 'method':90C 'obtain':50B,117C 'org.keycloak.services.resources.admin':72C 'potenti':131C 'privileg':61B,75C,128C 'realm':10A,55B,122C 'realm-admin':9A,54B,121C 'reset':104C 'resourc':136C 'right':57B 'role':5A,32B,83C,124C 'runtim':21B 'secret':46B,105C 'self':23B 'self-host':22B 'sensit':135C 'servic':37B,71C 'set':97C 'sever':89C 'sign':41B,109C 'success':111C 'swap':99C 'token':12A,52B,119C 'type':44B,102C 'unauthor':132C 'user':26B 'vulner':87C 'web':95C","nicknames":[],"mitigations":[],"who_affected":"Keycloak deployments where some accounts hold the manage-clients role, since that role is the required starting point. Deployments where only fully trusted administrators have client-management rights carry less practical risk. The sources do not list affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","keycloak","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-9797':15A,18A 'admin':11A 'client':4A 'cve':13A,16A 'escal':7A 'keycloak':1A 'manag':3A 'manage-cli':2A 'realm':10A 'realm-admin':9A 'role':5A 'token':12A","search_b":"'admin':36B,56B 'authent':43B 'carri':53B 'chang':39B 'client':31B,40B 'escal':62B 'hold':27B 'host':24B 'ident':19B 'key':42B 'keycloak':20B,34B 'let':48B 'manag':30B 'manage-cli':29B 'obtain':50B 'privileg':61B 'realm':55B 'realm-admin':54B 'right':57B 'role':32B 'runtim':21B 'secret':46B 'self':23B 'self-host':22B 'servic':37B 'sign':41B 'token':52B 'type':44B 'user':26B","search_c":"'access':133C 'admin':123C 'administr':70C 'allow':113C 'assign':125C 'attack':76C,115C 'authent':77C,101C 'client':82C,93C,100C 'could':84C 'download':107C 'escal':129C 'exploit':85C,112C 'flaw':64C 'found':66C 'high':74C 'includ':91C 'json':94C 'jwks':98C 'key':96C,110C 'keycloak':68C 'lead':126C 'legitim':108C 'manag':81C 'manage-cli':80C 'manipul':92C 'method':90C 'obtain':117C 'org.keycloak.services.resources.admin':72C 'potenti':131C 'privileg':75C,128C 'realm':122C 'realm-admin':121C 'reset':104C 'resourc':136C 'role':83C,124C 'secret':105C 'sensit':135C 'servic':71C 'set':97C 'sever':89C 'sign':109C 'success':111C 'swap':99C 'token':119C 'type':102C 'unauthor':132C 'vulner':87C 'web':95C","first_public_at":"2026-11-06T07:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9797","severity":null,"published_at":"2026-11-06T07:18:06+00:00","modified_at":"2026-11-06T07:18:12+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","fetched_at":"2026-11-06T07:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}