Keycloak RoleContainerResource Authorization Bypass in Admin REST API
CVE-2026-16105 Published on July 31, 2026
Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints
A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.
Vulnerability Analysis
CVE-2026-16105 can be exploited with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-16105 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-16105
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
