CVE-2026-94215: Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.
Other sources
A Missing Authorization vulnerability was discovered in Keycloaks Admin REST API. The flaw exists in the way the API resolves client resources using the per-request in-memory cache in the org.keycloak.models.cache.infinispan component. The cache is keyed by client UUID alone and does not perform a realm ownership validation when a resource is retrieved. An authenticated attacker with the create-realm role in the master realm can exploit this by creating a new realm and then addressing a master realm client using its UUID through the attacker-controlled realms API path. If the master realm client is present in the per-request cache, the system returns or updates the master client instead of enforcing realm boundaries. Successful exploitation allows an attacker to: Read client details, including credentials of confidential clients in the master realm.
Overwrite client configurations, such as injecting arbitrary redirect URIs into built-in master clients like admin-cli or security-admin-console.
Turn the master authorization endpoint into an open redirect.
Potentially affect other resource types that utilize the same per-request cache pattern.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which accounts are realistically able to exploit this issue?
An attacker must be authenticated and have the create-realm role in the master realm. They can create a realm they control and use that realm's API path to target a master-realm client by UUID.
What could an attacker do after exploiting the flaw?
The attacker may read or modify sensitive client configuration in the master realm. This could expose client credentials or redirect administrative login attempts to malicious sites.