---
id: "CVE-2026-9797"
page: "https://infrastack.ai/live/CVE-2026-9797"
kind: "vulnerability"
aliases: ["CVE-2026-9797"]
title: "Keycloak: manage-clients role can escalate to realm-admin tokens"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["identity", "keycloak", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-manage-clients-holders"]
published_at: "2026-11-06T07:18:06+00:00"
first_seen_at: "2026-11-06T07:40:16+00:00"
updated_at: "2026-11-06T07:41:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9797", "first_seen_at": "2026-11-06T07:40:16+00:00"}]
exploit_sources: []
---

# Keycloak: manage-clients role can escalate to realm-admin tokens

Link for people: https://infrastack.ai/live/CVE-2026-9797 (this .md is for agents)

A user holding the manage-clients role in Keycloak's admin services can change client signing keys, authenticator types or secrets. That lets them obtain a token carrying realm-admin rights, which is a privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Keycloak version with `kc.sh --version` or the admin console footer; compare against the fixed versions in the NVD entry
- List users and roles holding `manage-clients` in each realm and review whether they should have it

## Timeline

- 2026-11-06T07:40:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9797

## From the sources

A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_