CVE-2026-3121 MEDIUM

CVE-2026-3121: Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Vendor Red Hat
Product Red Hat build of Keycloak 26.4.11
Weakness CWE-266
Published March 26, 2026
Last update April 2, 2026

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

Key dates

02Disclosure timeline

March 26, 2026 CVE published
April 2, 2026 Record updated