Vulnerability Report

CVE-2026-3121

Title: Keycloak administrator privilege escalation via `manage-clients` permission

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2026-3121.

CWE Category CWE-266

Published Date Mar 26, 2026

Modified Date Apr 02, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.1

Exploit Probability (EPSS)

0.53%

Vulnerability Summary

CVE-2026-3121: A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.

Impacted Vendors

broadcom 1

pivotal 1

redhat 4

Reference Links

https://access.redhat.com/security/cve/CVE-2026-3121 https://bugzilla.redhat.com/show_bug.cgi?id=2442277

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N