CVE-2026-4636
Redhat Build Of Keycloak 26.2 … 26.4.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-4636 is a high-severity Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CWE-551) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-4636 is a vulnerability in Keycloak that allows an authenticated user with the uma_protection role to bypass User-Managed Access (UMA) policy validation. Specifically, the flaw enables the attacker to include resource identifiers owned by other users in a policy creation request, despite the URL path referencing an attacker-owned resource. This issue is associated with CWE-551 (Incorrect Behavior Order: Early Validation) and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts accessible over the network with low privileges required.
An attacker with an authenticated account possessing the uma_protection role can exploit this vulnerability remotely without user interaction. By crafting a policy creation request that mixes victim-owned resource identifiers with an attacker-controlled resource path, the attacker bypasses validation and gains unauthorized permissions over the victim's resources. This escalation allows the attacker to obtain a Requesting Party Token (RPT), enabling access to sensitive information or execution of unauthorized actions on those resources.
Red Hat has addressed this vulnerability through multiple errata releases, including RHSA-2026:6475, RHSA-2026:6476, RHSA-2026:6477, and RHSA-2026:6478, which provide patches for affected Keycloak deployments. Additional details are available in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-4636. Security practitioners should apply these updates promptly to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18213
Vulnerability Data
A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the…
more
URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires correct enforcement of authorizations on requests, which structurally demands parsing and canonicalization occur first so that the check cannot be bypassed.
SI-10 mandates validation (including canonicalization) of inputs before security decisions are made, directly stopping the incorrect ordering that enables the bypass.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct authorization logic after parsing/canonicalization to prevent bypasses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect this weakness but does not prevent it by itself.
Secure development lifecycle requires proper URL parsing and canonicalization before authorization checks.
Application security requirements should mandate correct authorization order after canonicalization.
Secure architecture principles include proper request handling order to prevent bypasses.
Secure coding practices directly address canonicalization and authorization sequencing flaws.
Information access restriction is undermined when authorization occurs before canonicalization.