Red Hat build of Keycloak: Privilege escalation to realm-admin via group move
Summary
A flaw in the group-move and organization group reparenting endpoints of keycloak-services allows an authenticated delegated administrator to move a group they control under an administrative group. All members of the moved group then inherit full realm-admin privileges. This gives the attacker complete control over the realm, including users, credentials and security configuration. The attack requires valid delegated admin access, and the vulnerability is an incomplete fix of CVE-2026-94000.
Affected
- Red Hat build of Keycloak (all versions listed as affected by Red Hat)
- Red Hat Single Sign-On 7 is not affected according to the CVE record
Fixed in
Unknown. No official Red Hat fix has been confirmed yet. Upstream fix work exists in keycloak/keycloak pull request 54888, but its release status is not confirmed.
Workaround
- Red Hat has not published a mitigation that meets its criteria.
- Unofficial, not confirmed by Red Hat: restrict delegated administrator permissions and limit group-move rights to users who already hold realm-admin privileges.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public exploit code has been confirmed for this CVE. Public PoCs exist for the related CVE-2026-94000, which covers a different path.
- EPSS score not yet available.
Our recommendation
- Check whether you run Red Hat build of Keycloak and identify all delegated administrators and accounts with group-management rights.
- Restrict group-move and group-management permissions to the smallest possible set of trusted administrators.
- Review group-membership changes and admin events for unexpected moves under administrative groups.
- Do not expose the admin console to the internet, and apply Red Hat's fix as soon as it is available.
- Also check the status of CVE-2026-94000 on your version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-116468 (CVE.org) www.cve.org
- Red Hat CVE page CVE-2026-116468 access.redhat.com
- Red Hat Bugzilla 2560575 bugzilla.redhat.com
- Upstream Keycloak issue 54341 github.com
- Upstream Keycloak pull request 54888 github.com
- The Hacker Wire CVE-2026-116468 www.thehackerwire.com
- SentinelOne CVE-2026-94000 (related CVE) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:41.
Original description (NVD)
A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.