GHSA-pq65-77rc-7r8c
Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition
At a glance
- Published
- Updated
- CVE
- CVE-2026-9796
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Description
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-server | introduced 0, fixed 26.6.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9796 ADVISORY
- https://github.com/keycloak/keycloak/issues/49427 WEB
- https://github.com/keycloak/keycloak/pull/49624 WEB
- https://github.com/keycloak/keycloak/commit/39cb8de54c8517efeda4baa8bc314fd40e9c6934 WEB
- https://access.redhat.com/errata/RHSA-2026:56523 WEB
- https://access.redhat.com/errata/RHSA-2026:56524 WEB
- https://access.redhat.com/security/cve/CVE-2026-9796 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2482464 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |