CVE-2026-3121
Privilege Escalation in Keycloak via Misconfigured Admin Permissions
Publication date: 2026-03-26
Last updated on: 2026-04-02
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | single_sign-on | 7.0 |
| redhat | jboss_enterprise_application_platform_expansion_pack | * |
| redhat | jboss_enterprise_application_platform | 8.0.0 |
| redhat | build_of_keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reviewing the Keycloak realm configuration and the permissions assigned to administrators. Specifically, check if the 'manage-clients' permission is granted to any administrator in a realm where admin permissions are enabled at the realm level.
To reproduce or detect the vulnerability, verify if an administrator with 'manage-clients' permission can escalate privileges by managing roles, users, or other administrative functions.
While no explicit commands are provided, the detection involves inspecting Keycloak realm settings under Realm Settings -> General to see if admin permissions are enabled, and auditing user permissions for 'manage-clients'.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves disabling admin permissions at the realm level in Keycloak to prevent the 'manage-clients' permission from equating to 'manage-permissions'.
Additionally, review and restrict the assignment of 'manage-clients' permission to administrators, ensuring it is only granted when absolutely necessary and with awareness of the associated privilege escalation risk.
Monitor and audit administrative roles and permissions regularly to detect any unauthorized privilege escalations.
Can you explain this vulnerability to me?
CVE-2026-3121 is a privilege escalation vulnerability in Keycloak. It occurs because an administrator with the `manage-clients` permission can exploit a misconfiguration where this permission is effectively equivalent to `manage-permissions`. This means that an admin who should only manage clients can actually manage permissions as well.
As a result, such an administrator can escalate their privileges by assigning themselves or others additional permissions, including control over roles, users, or other sensitive administrative functions within the Keycloak realm.
This vulnerability happens when admin permissions are enabled at the realm level in Keycloak, allowing the permission overlap to be exploited.
How can this vulnerability impact me? :
This vulnerability can allow an attacker who already has `manage-clients` administrator rights to escalate their privileges beyond their intended scope.
- Gain control over roles within the realm.
- Gain control over users and their permissions.
- Manage other sensitive administrative functions.
Such privilege escalation can lead to unauthorized access, modification, or disruption of the Keycloak realm's security and user management.