Skip to content
ThreatCluster

Moderate Vulnerability in Keycloak Client-Policy Executor Discovered

First seen 3 Aug 2026, 14:53 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 4, 2026 at 14:52 UTC
  • •CVE-2026-18570 allows bypassing security policies in Keycloak.
  • •Exploitation requires delegated client creation privileges.
  • •No effective mitigation options currently available.

A flaw has been identified in the keycloak-services component of Red Hat Build of Keycloak, specifically in the full-scope-disabled client-policy executor. This vulnerability, designated CVE-2026-18570, allows a delegated user to bypass security policies by omitting the 'fullScopeAllowed' field during client registration. As a result, clients can be created with full scope access, enabling unauthorized token acquisition. The Red Hat Product Security team has classified this vulnerability as Moderate, as exploitation requires specific privileges and policy configurations. The root cause is a failure to validate default server behavior when the required field is missing. Currently, no effective mitigation options are available that meet Red Hat's criteria for ease of use and stability. The CVE was published on August 2, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 75d ago How this analysis works

Timeline

2026-08-02
CVE-2026-18570 published
Red Hat disclosed a vulnerability in the keycloak-services component affecting client registration and configuration.
Nvd.Nist

More articles in this cluster (4)

Following this threat?

Track Red Hat and CVE-2026-18570 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3