Authorization Flaw in Keycloak's RoleContainerResource Component
CVE-2026-16105

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
31 July 2026

What is CVE-2026-16105?

A vulnerability has been identified in the RoleContainerResource component of Keycloak whereby certain name-based endpoints within the admin REST API fail to enforce proper authorization checks when managing composite roles. This oversight allows a delegated administrator, equipped with manage-realm permissions, to potentially remove critical child roles from built-in admin roles. Such actions may lead to significant disruptions in administrative functions within an individual realm, compromising the integrity and management capabilities of the key security features in Keycloak.

References

https://access.redhat.com/security/cve/CVE-2026-16105
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2501738
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank localhost-detect for reporting this issue.
.