CVE-2026-9795: Keycloak Services Privilege Escalation via Improper Scope Mapping Enforcement
Summary
CVE-2026-9795: Keycloak has privilege escalation via improper scope mapping enforcement. Affects org.keycloak:keycloak-services versions < 26.6.4. Fixed in 26.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure applications and services with little to no code. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature is designed to enforce strict access controls for managing client permissions. However, a vulnerability has been identified that compromises these controls, potentially allowing unauthorized privilege escalation.
Vulnerability Detail
A flaw exists in Keycloak's FGAPv2 feature where an administrator with limited client management permissions can exploit the system to assign any realm role, including highly privileged roles, to a client's scope mapping. This vulnerability allows the injected role to be included in a user's authentication token when accessing the modified client, leading to unauthorized privilege escalation within the Keycloak realm. The vulnerability is classified under CWE-266, indicating improper privilege management.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.6.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should review and restrict client management permissions to prevent unauthorized role assignments until the package is updated. Additionally, monitoring user roles and access tokens for any anomalies can help mitigate risks.
Conclusion
In summary, CVE-2026-9795 represents a significant security risk for Keycloak users due to improper scope mapping enforcement that can lead to privilege escalation. It is crucial to update to version 26.6.4 or later to mitigate this risk. Additionally, organizations should consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
CVE-2026-9795 is a vulnerability in Keycloak that allows privilege escalation through improper scope mapping enforcement.
Any organization using Keycloak version prior to 26.6.4 with Fine-Grained Admin Permissions enabled may be affected.
Exploitation of this vulnerability can lead to unauthorized access and privilege escalation within the Keycloak realm, compromising security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
