# Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984) · pwn.watch > Red Hat disclosed a flaw in Keycloak's client management component (keycloak-services). When a client is created or imported with authorization services enabled, Keycloak fails to clear an internal session attribute used during setup. An authenticated attacker who holds client management permissions (manage-clients) can use that to get past the checks that normally block uploaded JavaScript policies and import a malicious inline JavaScript policy, which the server then executes when an authorization request comes in. That gives the attacker arbitrary code execution on the Keycloak server and can compromise the whole system. Red Hat rates it CVSS 3.1 9.1 (Critical; network, low complexity, high privileges required, scope changed). The CVE was published on Nov 7 2026; no fixed Keycloak or Red Hat Build of Keycloak release is listed yet (it is not in the Keycloak 26.8.2 release notes and the Red Hat bug is still NEW), and no exploitation has been reported. Page: https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984 · generated 2026-11-07T15:52:51.004Z ## Status - Severity: critical · status: live · patch: unpatched - Product: Keycloak / Red Hat Build of Keycloak (keycloak-services) - Started: 2026-11-07 - CVEs: CVE-2026-120984 - Affected: Keycloak (keycloak-services) with authorization services, up to and including 26.8.2 (no fixed release listed yet); Red Hat Build of Keycloak (keycloak-services) until Red Hat ships a fixed build ## Follow this incident - RSS (one item per update): https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984/feed.xml - JSON Feed: https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984.json - This file: https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984/llms.txt ## Updates (newest first) - 2026-11-07: Red Hat publishes CVE-2026-120984 (CVSS 3.1 9.1): a stale session attribute left after creating or importing a client with authorization services lets a client manager upload a malicious JavaScript policy that runs on the server. No fixed version is listed yet. (https://nvd.nist.gov/vuln/detail/CVE-2026-120984) - 2026-11-03: Red Hat opens Bugzilla 2565599: "manage-clients to arbitrary code execution through inline JavaScript policy import" in keycloak-services. (https://bugzilla.redhat.com/show_bug.cgi?id=2565599) ## Fix brief # Security brief: Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984) Source: https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984 · status: live · severity: critical · updated Nov 7, 2026, 14:29 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Red Hat disclosed a flaw in Keycloak's client management component (keycloak-services). When a client is created or imported with authorization services enabled, Keycloak fails to clear an internal session attribute used during setup. An authenticated attacker who holds client management permissions (manage-clients) can use that to get past the checks that normally block uploaded JavaScript policies and import a malicious inline JavaScript policy, which the server then executes when an authorization request comes in. That gives the attacker arbitrary code execution on the Keycloak server and can compromise the whole system. Red Hat rates it CVSS 3.1 9.1 (Critical; network, low complexity, high privileges required, scope changed). The CVE was published on Nov 7 2026; no fixed Keycloak or Red Hat Build of Keycloak release is listed yet (it is not in the Keycloak 26.8.2 release notes and the Red Hat bug is still NEW), and no exploitation has been reported. Severity detail: CVSS 3.1 9.1 (Red Hat, AV:N/AC:L/PR:H/UI:N/S:C); needs an account with client management (manage-clients) permissions; leads to code execution on the Keycloak server; no fix listed yet; no exploitation reported - Product: Keycloak / Red Hat Build of Keycloak (keycloak-services) - CVE / advisory ids: CVE-2026-120984 ## Affected versions - Keycloak (keycloak-services) with authorization services, up to and including 26.8.2 (no fixed release listed yet) - Red Hat Build of Keycloak (keycloak-services) until Red Hat ships a fixed build ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If you run Keycloak with authorization services, review who holds manage-clients (and realm admin) permissions and cut that list to people who truly need it, since anyone with it can reach code execution on the server. Watch for unexpected JavaScript policies on clients, and upgrade as soon as Keycloak or Red Hat ships a fix. ## Latest updates - Nov 7, 2026: Red Hat publishes CVE-2026-120984 (CVSS 3.1 9.1): a stale session attribute left after creating or importing a client with authorization services lets a client manager upload a malicious JavaScript policy that runs on the server. No fixed version is listed yet. - Nov 3, 2026: Red Hat opens Bugzilla 2565599: "manage-clients to arbitrary code execution through inline JavaScript policy import" in keycloak-services. ## Advisories - [CVE-2026-120984](https://access.redhat.com/security/cve/CVE-2026-120984) (Red Hat) - [CVE-2026-120984](https://nvd.nist.gov/vuln/detail/CVE-2026-120984) (NVD) - [Bugzilla 2565599: manage-clients to arbitrary code execution through inline JavaScript policy import](https://bugzilla.redhat.com/show_bug.cgi?id=2565599) (Red Hat Bugzilla) ## Caveats Watch Keycloak releases and Red Hat errata for a fixed version. --- Machine-readable: https://pwn.watch/i/keycloak-inline-js-policy-import-rce-cve-2026-120984.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.