CVE-2026-15572: Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
Other sources
A policy bypass vulnerability exists in Keycloak's Dynamic Client Registration (DCR) "Allowed Protocol Mapper Types" policy. The root cause is located in the testMappers() method of ProtocolMappersClientRegistrationPolicy.java. When a client is updated, the policy checks if the protocol mapper type is in the allow-list. If it is not, the code attempts to verify if the mapper already exists. However, it only validates that the config map of the incoming mapper matches the config of the existing persisted mapper; it fails to verify that the protocolMapper type itself has not changed. An attacker can exploit this by: Registering a client with an allowed mapper type (e.g., oidc-usermodel-attribute-mapper) but providing a configuration intended for a restricted mapper (e.g., {"role": "realm-management.realm-admin"}).
Performing a DCR PUT update that keeps the configuration identical but changes the protocolMapper type to a disallowed one, such as oidc-hardcoded-role-mapper.
Because the configuration is identical, the policy bypasses the type check. Once persisted, the oidc-hardcoded-role-mapper uses the "role" configuration to inject the realm-admin role into the client's tokens, escalating the attacker to a full realm administrator.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15572?
CVE-2026-15572 has a high severity rating of 8.8.
How do I fix CVE-2026-15572?
To fix CVE-2026-15572, update the Keycloak Dynamic Client Registration software to the latest version that includes the security patch.
What does CVE-2026-15572 affect?
CVE-2026-15572 affects the security policy management of Keycloak's Dynamic Client Registration.
What kind of vulnerability is CVE-2026-15572?
CVE-2026-15572 is a privilege escalation vulnerability due to a bypass in the Allowed Protocol Mapper Types policy.
What is the impact of CVE-2026-15572?
The impact of CVE-2026-15572 is that it allows unauthorized privilege escalation for clients by bypassing protocol mapper type restrictions.