CVE-2026-4629
Redhat Build Of Keycloak
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-4629 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-40300
Vulnerability Data
A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin`…
more
role into generated tokens, resulting in privilege escalation and full administrative access to the realm.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Privileged user bypasses scope restrictions via role injection to escalate to realm-admin, directly enabling abuse of elevation mechanisms.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly limits the excessive capabilities granted by manage-clients so that role-mapper injection and realm-admin escalation cannot occur.
Enforces fine-grained authorization checks that would block the unauthorized insertion of realm-admin role mappings into client tokens.
Controls information flow during token generation to stop the injection of out-of-scope roles such as realm-admin.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.