Medium severity6.5NVD Advisory· Published May 28, 2026· Updated Sep 15, 2026
CVE-2026-9796
CVE-2026-9796
Description
A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-serverMaven | < 26.6.4 | 26.6.4 |
Affected products
3(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
Patches
Vulnerability mechanics
References
9- access.redhat.com/security/cve/CVE-2026-9796nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-pq65-77rc-7r8cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-9796ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:56523nvdWEB
- access.redhat.com/errata/RHSA-2026:56524nvdWEB
- github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934ghsaWEB
- github.com/keycloak/keycloak/issues/49427ghsaWEB
- github.com/keycloak/keycloak/pull/49624ghsaWEB
News mentions
1- Keycloak: Twelve Vulnerabilities Disclosed, One High SeverityVypr Intelligence · May 28, 2026