Advisory · CVE-2026-120984
Keycloak client setup flaw lets privileged admins run code on the server
An authenticated attacker with client management permissions can bypass script-policy upload restrictions during client creation or import and upload a malicious JavaScript policy that executes on the Keycloak server, rated critical at CVSS 9.1.
- Vendor
- Red Hat
- Product
- Keycloak
- Identifier / CWE
- CVE-2026-120984
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Keycloak normally blocks admins from uploading runnable scripts as authorization rules. A leftover setting from creating a client leaves the door open, so an admin with client duties can slip in a script that runs on the server.
- 01Client created with authorization
An attacker holding client management permissions creates or imports a client with authorization services enabled.
- 02Session attribute left behind
Keycloak fails to clear an internal session attribute used during the client setup process.
- 03Script policy uploaded
The leftover state lets the attacker bypass the upload restriction and submit a malicious JavaScript policy.
- 04Policy executes on the server
When an authorization request is made, the script runs inside the Keycloak server process, giving the attacker code execution.
What happened
Red Hat disclosed CVE-2026-120984 on November 7, 2026: a flaw in the Keycloak server’s client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. That lets an authenticated attacker with client management permissions bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. The record rates it critical at CVSS 9.1 under version 3.1, with network attack vector, low complexity, high privileges required, no user interaction, and changed scope.
Red Hat rates the flaw Important rather than Critical because exploitation needs an authenticated attacker with delegated client management roles, and notes that script-based policies are restricted by default in multi-tenant deployments. The flaw breaks that restriction: the injected script executes within the application server process, breaking realm boundaries and potentially compromising the host environment and co-hosted realms. No fixed version or mitigation is published in the Red Hat bulletin as of this advisory, so none is claimed here.
What to do
- Inventory Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On deployments and record each version.
- Audit who holds client management permissions and narrow those roles to the smallest set of administrators who need them.
- Review existing JavaScript authorization policies for scripts that cannot be accounted for.
- Review logs for client creation and import events and for authorization policy uploads.
- Treat any unexpected JavaScript policy as a compromise indicator and investigate the realms it could reach.
- Apply the vendor fix when Red Hat publishes one, and verify the deployed version after updating.
Management note
The attacker needs a privileged account, but client management is a delegated admin role, not a rare one. In a multi-tenant identity platform, a script running in the server process is a realm-boundary failure, so audit policies before assuming the blast radius is one realm.