Keycloak: manage-users admin escalates to manage-realm via composite role mapping (CVE-2026-96448)
Severity: medium · Patch status: unpatched · Since 2026-09-25 · CVE-2026-96448
On 3 Nov 2026 Abraxas Labs published a lab proof of concept showing that a holder of manage-users, a delegated help-desk role that should not reach admin powers, can map a realm or client role onto their own account. That role's own name is not an admin role, but its composites include manage-realm or realm-admin. After the mapping, the same access token reads the full realm document and carries the nested admin role. A realm administrator must have built such a composite first. The defect is in the role-mapping permission check (RolePermissionsV2.canMapRole): for any non-admin role it returns true for manage-users and never walks the role's composites. We re-read that check at tags 26.8.1 and 26.7.5 and found it unchanged in both. Red Hat and NVD describe the same check as CVE-2026-96448, published 25 Sep 2026 and rated Moderate (CVSS 3.1 6.6); the write-up's 'no CVE' statement does not hold, and the write-up does not cite the CVE. Red Hat marks Red Hat Build of Keycloak as affected. We found no fixed upstream release and no community fix as of the 27 Sep 2026 analysis by Skycloak; no exploitation has been reported, and NVD's CISA SSVC enrichment lists exploitation as none and not automatable. The related CVE-2026-94000 (group-join composite walk, Red Hat Moderate) was closed upstream on 22 Sep 2026 as issue 53060; it is a sibling, not this defect. Until a fix ships, remove admin-including composites from roles that are not meant to grant admin, and cut manage-users down to the staff who need it.
What to do
- Audit every realm role and client role for composites that include realm-management admin roles (manage-realm, realm-admin, manage-clients, manage-authorization and so on). Remove them from any role that is not itself meant to grant admin.
- Until a fix ships, treat every manage-users holder as able to reach any admin power that sits inside such a composite. Cut manage-users down to the people who need it.
- Hunt in admin events: look for role-mapping CREATE operations where the target user is the acting admin (resourcePath users/<own-id>/role-mappings/...), especially for composite roles.
- Watch the Keycloak security advisories for a CVE and fixed release, and upgrade when one ships.
Sources
All live incidents on Threat Watch
