Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984) ยท updates https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984 Red Hat disclosed a flaw in Keycloak's client management component (keycloak-services). When a client is created or imported with authorization services enabled, Keycloak fails to clear an internal session attribute used during setup. An authenticated attacker who holds client management permissions (manage-clients) can use that to get past the checks that normally block uploaded JavaScript policies and import a malicious inline JavaScript policy, which the server then executes when an authorization request comes in. That gives the attacker arbitrary code execution on the Keycloak server and can compromise the whole system. Red Hat rates it CVSS 3.1 9.1 (Critical; network, low complexity, high privileges required, scope changed). The CVE was published on Nov 7 2026; no fixed Keycloak or Red Hat Build of Keycloak release is listed yet (it is not in the Keycloak 26.8.2 release notes and the Red Hat bug is still NEW), and no exploitation has been reported. en Sat, 07 Nov 2026 00:00:00 GMT Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984): Red Hat publishes CVE-2026-120984 (CVSS 3.1 9.1): a stale session attribute left after creating or importing a client with authorization services lets a client manager upload a malicious JavaScript policy that runs on the server. No fixed version is listed yet. https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984 https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984#2026-11-07-aa39a0dc Sat, 07 Nov 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-120984">Source</a></p> Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984): Red Hat opens Bugzilla 2565599: "manage-clients to arbitrary code execution through inline JavaScript policy import" in keycloak-services. https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984 https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984#2026-11-03-d2c72db5 Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2565599">Source</a></p>