QSearchQSearch

CVE-2026-9796

6.5 MEDIUM

A flaw was found in Keycloak

Published: 2026-05-28 · Last updated: 2026-06-03

Severity and scoring

CVSS
6.5 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE
CWE-367

Affected products

VendorProduct
redhatbuild_of_keycloak

Description

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-11793 — A stack buffer overflow flaw was found in 389 Directory Server (4.9 MEDIUM)
  • CVE-2026-11790 — A flaw was found in 389 Directory Server (4.9 MEDIUM)
  • CVE-2026-11789 — A flaw was found in 389 Directory Server (4.9 MEDIUM)
  • CVE-2026-11788 — A flaw was found in 389 Directory Server (5.9 MEDIUM)
  • CVE-2026-11787 — A flaw was found in 389 Directory Server (5.0 MEDIUM)

Same CWE

  • CVE-2026-54228 — A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method (7.8 HIGH)
  • CVE-2026-53838 — OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approv... (9.8 CRITICAL)
  • CVE-2026-53831 — OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expan... (8.3 HIGH)
  • CVE-2026-53822 — OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution (8.8 HIGH)
  • CVE-2026-54055 — Kitty is a cross-platform GPU based terminal (5.0 MEDIUM)