Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-21 | 1 | Disclosure1 |
| 2026-10-23 | 1 | Patch1 |
CVE-2026-94215 A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-mem… https://www.cve.org/CVERecord?id=CVE-2026-94215
Post summary
The message discloses a newly identified vulnerability in Keycloak's Admin REST API tied to its per-request in-memory processing, referencing the CVE entry for more information.
CVE-2026-94215 Keycloak Admin REST API flaw lets low-priv admins read/modify master realm client configs via a realm they control. CVSS 5.5, currently unpatched. Review access and patch as soon as a fix lands. #CVE #infosec #Keycloak https://www.valtersit.com/cve/CVE-2026-94215 #Keycloak #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text reports CVE-2026-94215 as an unpatched Keycloak Admin REST API flaw (CVSS 5.5) allowing privilege escalation for low-priv admins, with an explicit recommendation to patch as soon as a fix is available.