{"id":"CVE-2026-9797","aliases":[],"cve":{"records":[{"id":"CVE-2026-9797","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-28T03:49:30.991Z","published":"2026-11-06T06:36:10.498Z","modified":"2026-11-06T17:35:07.672Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T06:36:10.498Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-06T17:35:07.672Z"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-9797","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482468","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-266","description":"Incorrect Privilege Assignment","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-06T17:34:56.632259Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.","score":6.5,"severity":"medium","published":"2026-11-06T06:36:10.498Z","modified":"2026-11-06T17:35:07.672Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Build of Keycloak","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-9797"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-9797"}],"references":["https://access.redhat.com/security/cve/CVE-2026-9797","https://bugzilla.redhat.com/show_bug.cgi?id=2482468"],"sources":[{"name":"CVE","id":"CVE-2026-9797","modified":"2026-11-06T17:35:07.672Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-9797"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-06T17:56:53.643Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T09:05:36.012Z","attemptedAt":"2026-11-06T09:05:36.012Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T09:05:35.705Z","attemptedAt":"2026-11-06T09:05:35.705Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T09:05:37.325Z","attemptedAt":"2026-11-06T09:05:37.325Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T09:05:35.978Z","attemptedAt":"2026-11-06T09:05:35.978Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-9797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9797","modified":"2026-11-06T07:18:12.557","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T09:05:36.012Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117964","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117964","modified":"Nov 6, 2026, 6:36:10 AM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","checkedAt":"2026-11-06T09:05:37.325Z"}],"aiSummary":{"text":"A flaw in Keycloak's administrative services allows a highly privileged, authenticated attacker with a 'manage-clients' role to manipulate client authentication, potentially leading to privilege escalation. The attacker could obtain a token with 'realm-admin' role assignments, accessing sensitive resources. Exploitation requires authenticated access with a specific role.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T09:01:05.830Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-9797"}]}}