Cyber Resilience

CVE-2026-9796

Race Condition in Redhat Build Of Keycloak

Race Condition
Published
28 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0019 9th percentile
Risk Priority 41 floored blend · peak EPSS

Summary

CVE-2026-9796 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Redhat Build Of Keycloak. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-5 (Separation of Duties) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users…

more

within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

CWE(s)
CWE-367

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

TOCTOU flaw in role checks directly enables authenticated admin privilege escalation to realm-admin via vulnerability exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
TOCTOU race in name-based admin role checks directly enables privilege escalation from manage-clients to realm-admin.
attack.mitre.org →
T1098.007 Additional Local or Domain Groups Persistenceconfidence: HIGH
Escalation grants the attacker additional local/domain groups (realm-admin) that persist after revocation.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalationconfidence: MEDIUM
Abuse of the elevation-control mechanism (role checks) is the root cause of the privilege escalation.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-9704Same product: Redhat Build Of Keycloak
CVE-2025-7784Same product: Redhat Build Of Keycloak
CVE-2026-4636Same product: Redhat Build Of Keycloak
CVE-2026-9099Same product: Redhat Build Of Keycloak
CVE-2026-9795Same product: Redhat Build Of Keycloak
CVE-2026-4282Same product: Redhat Build Of Keycloak
CVE-2026-9800Same product: Redhat Build Of Keycloak
CVE-2026-9793Same product: Redhat Build Of Keycloak
CVE-2026-4628Same product: Redhat Build Of Keycloak
CVE-2026-9792Same product: Redhat Build Of Keycloak

Affected Assets

redhat
build of keycloak
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-5 Separation of Duties
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces authorization decisions on role checks; the TOCTOU flaw in name-based admin role evaluation allows unauthorized escalation from manage-clients to realm-admin.

AC-6 Least Privilege partial match
prevent

Restricts the permissions granted to the manage-clients role so that even a successful TOCTOU bypass cannot yield full realm-admin rights.

AC-5 Separation of Duties partial match
prevent

Separates duties between client-management and realm-wide administration, eliminating the composite role path that persists after the attack.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References