CVE-2026-18570: Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.
Other sources
A Missing Authorization vulnerability was found in the Keycloak full-scope-disabled client-policy executor. When the executor is configured with auto-configure disabled, it fails to properly validate client creation or update requests that omit the fullScopeAllowed field. Because the server defaults to fullScopeAllowed=true for non-consent clients, an attacker with delegated client creation privileges can bypass the intended restriction. Successful exploitation allows an attacker to create a client that possesses full scope access within the realm, even when a policy is active to prevent it. This results in the issuance of tokens containing role mappings that should have been restricted by the realm policy.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18570?
CVE-2026-18570 has a medium severity rating of 5.4.
How do I fix CVE-2026-18570?
To mitigate CVE-2026-18570, ensure that proper client policy validation is enforced and full scope settings are correctly configured in keycloak-services.
What component is affected by CVE-2026-18570?
CVE-2026-18570 affects the keycloak-services component responsible for client policy validation.
What kind of vulnerability is CVE-2026-18570?
CVE-2026-18570 is a vulnerability that allows a bypass of full-scope-disabled client policy validation.
How does CVE-2026-18570 impact client registration in Keycloak?
CVE-2026-18570 can lead to improper enforcement of security policies during client registration and configuration due to a validation bypass.