Vulnerability · Published Jun 30, 2026 · Assigned by redhat
CVE-2026-12388Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper
Medium 6.5
In plain English
A medium-severity security flaw in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | see references |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-12388 vdb-entry, x_refsource_REDHAT
- RHBZ#2489140 issue-tracking, x_refsource_REDHAT