Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🟠 Keycloak, Privilege Escalation, #CVE-2026-9796 (Medium) -DC-Jun2026-159 https://dailycve.com/keycloak-privilege-escalation-cve-2026-9796-medium-dc-jun2026-159/
Post summary
A brief headline announcement of CVE‑2026‑9796, indicating it is a medium‑severity privilege escalation flaw in Keycloak, with no further technical, exploit, or mitigation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |