#Code Injection

Keycloak flaw lets client managers run code on the server through an imported JavaScript policy (CVE-2026-120984)

Red Hat disclosed a flaw in Keycloak's client management component (keycloak-services). When a client is created or imported with authorization services enabled, Keycloak fails to clear an internal session attribute used during setup. An authenticated attacker who holds client management permissions (manage-clients) can use that to get past the checks that normally block uploaded JavaScript policies and import a malicious inline JavaScript policy, which the server then executes when an authorization request comes in. That gives the attacker arbitrary code execution on the Keycloak server and can compromise the whole system. Red Hat rates it CVSS 3.1 9.1 (Critical; network, low complexity, high privileges required, scope changed). The CVE was published on Nov 7 2026; no fixed Keycloak or Red Hat Build of Keycloak release is listed yet (it is not in the Keycloak 26.8.2 release notes and the Red Hat bug is still NEW), and no exploitation has been reported.

Keycloak / Red Hat Build of Keycloak (keycloak-services)·Since Nov 7, 2026·updated Nov 7, 2026, 14:29 UTC