REDHAT-BUG-2459993: High severity Keycloak Keycloak vulnerability

Published Apr 21, 2026

Updated

Privilege escalation in Keycloak via POST /admin/realms/{realm}/partialImport. The endpoint bypasses Fine-Grained Admin Permissions (FGAP) -- it only checks requireManageRealm() but not per-resource-type permissions. A limited admin with only manage-realm can escalate to full realm admin by importing users with realm-admin role mappings. Verified on Keycloak 26.6.1.

Related: GitHub issue #9387 describes this as hardening, but it is an exploitable privilege escalation.

Affected Software

1 affected component

Keycloak Keycloak=26.6.1

Event History

Apr 21, 2026

Data Sourced

via Red Hat·07:35 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2459993?

The severity of REDHAT-BUG-2459993 is high, rated at 7.

What is the main issue described in REDHAT-BUG-2459993?

REDHAT-BUG-2459993 describes a privilege escalation vulnerability in Keycloak that allows limited admins to gain full realm admin access.

How does the vulnerability in REDHAT-BUG-2459993 occur?

The vulnerability occurs because the POST /admin/realms/{realm}/partialImport endpoint bypasses Fine-Grained Admin Permissions and only checks requireManageRealm() without validating per-resource-type permissions.

Who is affected by REDHAT-BUG-2459993?

Users with limited admin roles that only have manage-realm permissions in Keycloak are affected by REDHAT-BUG-2459993.

How can I fix the vulnerability identified in REDHAT-BUG-2459993?

To fix REDHAT-BUG-2459993, update to a patched version of Keycloak that addresses the privilege escalation issue.