CVE-2026-4629: Keycloak: keycloak: privilege escalation through hardcoded role mapper injection
A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
Other sources
A user with manage-clients permission can escalate to realm-admin by injecting a hardcoded role mapper into any client. The mapper injects realm-admin into tokens at generation time, bypassing scope restrictions.
Steps to reproduce:
1. Create a user with only manage-clients role (no user/role/realm access) 2. As attacker, add oidc-hardcoded-role-mapper to any client with config: {"role": "realm-management.realm-admin"} 3. Authenticate through that client 4. Token is generated with realm-admin role injected (bypasses fullScopeAllowed: false) 5. Use token to call admin API — full realm-admin access confirmed
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4629?
The severity of CVE-2026-4629 is classified as medium with a score of 6.5.
What is CVE-2026-4629 about?
CVE-2026-4629 is a privilege escalation vulnerability in Keycloak that allows a highly privileged user to inject a hardcoded role mapper into clients.
How do I fix CVE-2026-4629?
To fix CVE-2026-4629, ensure that highly privileged users do not have the unnecessary ability to manage clients or limit their permissions as needed.
Who is affected by CVE-2026-4629?
CVE-2026-4629 affects installations of Keycloak where highly privileged users have the ability to manage clients.
What impact does CVE-2026-4629 have on Keycloak security?
The impact of CVE-2026-4629 allows an attacker to bypass scope restrictions and potentially gain elevated privileges by injecting the realm-admin role into tokens.