Privilege Escalation Vulnerability in Keycloak Admin REST API
CVE-2026-94000

6.6MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
19 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-94000?

A security flaw in the Admin REST API of Keycloak allows a delegated administrator with limited permissions to gain unauthorized access to high-privilege groups. This occurs because the system does not properly verify if a group grants administrative rights before enabling a user to be added. This oversight can allow malicious users to elevate their permissions significantly, compromising the integrity and security of the entire realm.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

KeycloakESC
Created by SecFathy

References

https://access.redhat.com/security/cve/CVE-2026-94000
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2537168
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank SECTION: Create Trackers {yes for reporting this issue.
.