Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984)

Red Hat disclosed a flaw in Keycloak's client management component (keycloak-services). When a client is created or imported with authorization services enabled, Keycloak fails to clear an internal session attribute used during setup. An authenticated attacker who holds client management permissions (manage-clients) can use that to get past the checks that normally block uploaded JavaScript policies and import a malicious inline JavaScript policy, which the server then executes when an authorization request comes in. That gives the attacker arbitrary code execution on the Keycloak server and can compromise the whole system. Red Hat rates it CVSS 3.1 9.1 (Critical; network, low complexity, high privileges required, scope changed). The CVE was published on Nov 7 2026; no fixed Keycloak or Red Hat Build of Keycloak release is listed yet (it is not in the Keycloak 26.8.2 release notes and the Red Hat bug is still NEW), and no exploitation has been reported.

Why this severity: CVSS 3.1 9.1 (Red Hat, AV:N/AC:L/PR:H/UI:N/S:C); needs an account with client management (manage-clients) permissions; leads to code execution on the Keycloak server; no fix listed yet; no exploitation reported

Started

Nov 7, 2026

CVE

CVE-2026-120984

• Java
• #Keycloak
• #Red Hat
• RCE
• #Code Injection
• #Privilege escalation

Notes & caveats

Watch Keycloak releases and Red Hat errata for a fixed version.