Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T02:02:00 keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-843

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.

The Red Hat Product Security team has assessed the severity of this vulnerability as Important. Successful exploitation allows an attacker with client registration privileges to escalate to realm administrator, granting them full control over the affected realm. This includes the ability to modify security settings, access sensitive user data, or cause a denial of service. The vulnerability stems from an asymmetric enforcement of the protocol mapper allow-list during client updates, where the system fails to re-validate the mapper type if the configuration remains unchanged. Red Hat would like to thank Arthur Chan (Ada Logics) for reporting this issue. Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-operator-bundle:26.4.14-1 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9:26.4-22 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9-operator:26.4-22 Red Hat build of Keycloak 26.4.14 2026-08-05T00:00:00Z RHSA-2026:50846 rhbk/keycloak-rhel9 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-operator-bundle:26.6.5-1 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9:26.6-11 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9-operator:26.6-11 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk/keycloak-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-15572 https://nvd.nist.gov/vuln/detail/CVE-2026-15572