Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-19 | 1 | Disclosure1 |
| 2026-10-14 | 1 | Patch1 |
| 2026-10-27 | 1 | Patch1 |
The release also fixes 20 other medium or low CVEs and multiple Keycloak weaknesses, including: CVE-2026-94000 (6.6): A delegated admin could add themselves to a higher-privilege group and become realm-admin.
Post summary
The text announces a release that patches CVE-2026-94000 (a Keycloak privilege escalation with CVSS 6.6) along with 20 other medium/low CVEs, providing technical details and confirming a fix is available.
CVE-2026-94000 Keycloak Admin REST API privilege escalation lets a delegated admin add themselves to a high-privilege group and take over the realm. CVSS 6.6, unpatched. Restrict delegated admin group perms now. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94000/ #Keycloak #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post details CVE-2026-94000 in Keycloak, describing its privilege escalation exploit and CVSS 6.6 severity, while explicitly recommending workaround mitigation steps to restrict delegated admin permissions.
CVE-2026-94000 A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where t… https://www.cve.org/CVERecord?id=CVE-2026-94000
Post summary
The text serves as a disclosure announcement for CVE-2026-94000, detailing a flaw in Keycloak's Admin REST API group-membership endpoints and linking to the official CVE record without mentioning exploitation, PoCs, or patches.