CVE-2026-11577Disclosure

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Rejected reason: The reported behavior does not constitute a privilege escalation. Exploitation requires the attacker to already possess the manage-realm administrative role within the realm-management client. By design, the manage-realm role is intended to be equivalent in administrative authority to realm-admin. A user with manage-realm already has full administrative control over the realm. Therefore, importing users with realm-admin role mappings through POST /admin/realms/{realm}/partialImport does not grant any additional privileges beyond those already held by the administrator and does not represent a security vulnerability.

Back to dashboard

0.5/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-11577

Full discourse2 posts

Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 High - Keycloak Fine-Grained Admin Permissions Bypass → Privilege Escalation (CVE-2026-11577) A limited Keycloak admin can escalate to full realm admin via the POST /admin/realms/{realm}/partialImport endpoint. Importing users with realm-admin role mappings bypasses Fine-Grained Admin Permissions (FGAP) (CVSS 7.2, requires authenticated limited admin). 👉 Affected: Keycloak / Red Hat Build of Keycloak (see vendor advisory for fixed versions) | Apply patched release + audit limited admins for unexpected realm-admin grants
Post summary
New CVE-2026-11577 allows a limited Keycloak admin to gain full realm admin rights via the partialImport endpoint; CVSS 7.2. A patch is available in vendor releases.
0000092
207 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-11577 A flaw was found in Keycloak. A limited administrator can exploit an improper access control vulnerability in the POST /admin/realms/{realm}/partialImport endpoint. T… https://www.cve.org/CVERecord?id=CVE-2026-11577
Post summary
CVE-2026-11577 reveals an improper access control flaw in Keycloak’s partialImport endpoint, but the brief description provides no PoC, exploit code, evidence of active exploitation, or patch information.
00000199
57.6K followersView on X

Explore more

Back to dashboard