6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9796

CVE-2026-9796: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

A flaw was found in Keycloak. An authenticated administrator with the manage-clients role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to realm-admin for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9796

CVE-2026-9796:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-server	maven	< 26.6.4	26.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation issue in Keycloak where an administrator with the manage-clients role could gain realm-admin privileges. This was possible due to insufficient permission checks when managing roles, particularly roles associated with internal clients like realm-management.

The analysis of the patch 39cb8de54c8517efeda4baa8bc314fd40e9c6934 reveals several key changes that fixed the vulnerability:

Missing Authorization in Role Management: The updateRole and deleteRole methods in org.keycloak.services.resources.admin.RoleContainerResource were missing a crucial permission check. The patch adds auth.roles().requireManage(role); to both methods, ensuring that the user has the necessary permissions to modify the target role before the operation is performed. The absence of this check is a primary vulnerability.
Access to Internal Clients: The canManage and canConfigure methods in org.keycloak.services.resources.admin.fgap.ClientPermissions (and canManage in ClientPermissionsV2) did not prevent administrators with manage-clients from modifying internal, sensitive clients (e.g., realm-management). The patch introduces an isInternal(client) check to explicitly deny management of these clients, closing the main attack vector.
Protection of Admin Roles: The canManage method in org.keycloak.services.resources.admin.fgap.RolePermissions was modified to prevent the modification of critical realm administration roles (like admin and create-realm) even by users with manage-realm permissions. This adds another layer of defense.

The exploit would involve an attacker with manage-clients role making an API call to update the realm-admin role (which is part of the internal realm-management client) to add a composite role that they control. This would grant them realm-admin privileges. The functions updateRole and deleteRole would be the entry points for such an attack, and the various canManage functions would be the authorization checks that were bypassed or insufficient. The vulnerability is described as a TOCTOU, which likely refers to the gap between checking permissions (which was insufficient) and the actual modification of the role.

Vulnerable functions

org.keycloak.services.resources.admin.RoleContainerResource.deleteRole

services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java

This function is used to delete a role. Before the patch, it did not properly verify if the user had the required permissions to delete the role in question. This allowed an attacker with `manage-clients` role to delete sensitive roles, such as those within the `realm-management` client, as part of a privilege escalation attack.

org.keycloak.services.resources.admin.RoleContainerResource.updateRole

services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java

This function is used to update a role. The vulnerability existed because this method did not enforce proper authorization checks, allowing an attacker with `manage-clients` permissions to modify roles they should not have access to, such as the `realm-admin` role, and add themselves to it as a composite role, leading to privilege escalation.

org.keycloak.services.resources.admin.fgap.ClientPermissions.canManage

services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java

This function checks if a user can manage a client. Before the patch, it did not distinguish between regular clients and internal clients. This allowed an administrator with `manage-clients` role to manage sensitive internal clients like `realm-management`, which was a key step in the exploit chain to modify administrative roles.

org.keycloak.services.resources.admin.fgap.ClientPermissions.canConfigure

services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java

Similar to `canManage`, this function checks if a user can configure a client. The lack of a check for internal clients allowed an attacker to configure sensitive clients, which could be leveraged to escalate privileges.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-9796: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2026-9796:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Detect and Respond To Threats Faster.

CVE-2026-9796: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

Basic Information

Basic Information

6.5

6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-9796: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2026-9796:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

CVE-2026-9796: Keycloak has a Time-of-check Time-of-use (TOCTOU) Race Condition

Basic Information

Basic Information

6.5

6.5

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI