redhat build-keycloak CVE-2026-17526 vulnerability in Red Hat Products
Published on September 16, 2026

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-17526 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 54 days later.

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-17526 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-17526

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Build Keycloak
 
Red Hat Jboss Data Grid
 
Red Hat Jbosseapxp
 
Red Hat Single Sign On
 

Affected Versions

Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4: Red Hat build of Keycloak 26.4.16: Red Hat build of Keycloak 26.4.16: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6: Red Hat build of Keycloak 26.6.7: Red Hat build of Keycloak 26.6.7: Red Hat build of Keycloak 26.6.7: Red Hat Data Grid 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Single Sign-On 7: