A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with
    limited client management permissions can exploit this vulnerability to assign any realm role, including
    highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing
    the injected role to be projected into a user's authentication token when they access the modified client.
    This could lead to unauthorized privilege escalation within the Keycloak realm. (CVE-2026-9795)

The version of Keycloak installed on the remote host is prior to 26.6.4. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A user with group-admin privileges can escalate to realm-admin, gaining full administrative control     over the realm. (CVE-2026-9099)

  - An authentication bypass exists via JWT algorithm confusion, allowing unauthorized access.
    (CVE-2026-11800)

  - Any authenticated user can bypass all authorization policies, including role, scope, and UMA     permission checks, by including the configured access-denied page path within a request URL, gaining     unauthorized access to protected resources. (CVE-2026-9800)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
460277	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.4	Tenable Cloud Security	Echo Local Security Checks	Local	high
460277	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.6.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
324966	Keycloak < 26.6.4 Multiple Vulnerabilities	Nessus	Misc.	Local	high
444254	SCA: security update for org.keycloak:keycloak-services (GHSA-32h4-44jj-c5vx)	Tenable Cloud Security	SCA Checks	Local	high
444254	SCA: security update for org.keycloak:keycloak-services (GHSA-32h4-44jj-c5vx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-9795

high

Tenable Plugins

high

high

high

high

high