Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Client is created or imported with authorization services enabled The same request includes an authorizationSettings payload
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Keycloak's client management component allows a remote attacker who has high-privilege, logged-in access to client management to upload a malicious JavaScript policy when a client is created or imported with authorization services enabled. The server then runs that policy when an authorization request is made, which could let the attacker execute arbitrary code on the server.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Shipped in major Linux distributions
- Severity9.1/10CVSS 9.1
- No patch5/5No patch listed yet
What would change the score
- Would score about 82 if added to CISA KEV
- Would score about 77 if CISA's SSVC rates exploitation active
- Would score about 39 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Client is created or imported with authorization services enabled The same request includes an authorizationSettings payloadWorkaround: The checked facts give no official workaround. Limiting who holds manage-clients rights and avoiding client creation or import with authorization services enabled and an authorizationSettings payload would narrow the exposure until a fix is installed.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- keycloak-services
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- keycloak-services
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120984
Is CVE-2026-120984 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A delegated administrator with manage-clients rights can inject JavaScript through an inline authorization policy import. The injected code runs in the Keycloak server JVM, where it can escape the administrator's realm boundary, read sensitive host data, change configuration for other realms, or shut down the system.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
The checked facts list Red Hat Build of Keycloak and Red Hat Single Sign-On 7 but give no version ranges. The bug needs a client to be created or imported with authorization services enabled, in the same request as an authorizationSettings payload. Compare your product and version against the Red Hat advisory for this CVE.Source: access.redhat.com, bugzilla.redhat.com
How do I fix CVE-2026-120984?
The checked facts name no fixed version, so no upgrade target is confirmed here. Check the Red Hat advisory for a fixed release of your product line and apply it when available.Source: access.redhat.com, bugzilla.redhat.com
What if there's no patch?
The checked facts give no official workaround. Limiting who holds manage-clients rights and avoiding client creation or import with authorization services enabled and an authorizationSettings payload would narrow the exposure until a fix is installed.Source: access.redhat.com, bugzilla.redhat.com