Keycloak CVE-2026-11577: Brief Summary of the partialImport FGAP Bypass Leading to Full Realm Privilege Escalation

Introduction

A limited Keycloak administrator can become a full realm administrator with a single API call, despite a permission model built to stop exactly that. CVE-2026-11577 affects the POST /admin/realms/{realm}/partialImport endpoint, which runs one coarse-grained authorization check where it should enforce granular FGAP permissions. An attacker can use it to import users with realm-admin role mappings and take complete control of the realm.

The underlying behavior is not new. It was reported as GitHub issue #9387 in January 2022 against Keycloak 16.1.0, labeled a "hardening" concern, and closed as "not planned." More than four years later, it has been reclassified as an exploitable privilege escalation vulnerability with a CVSS score of 7.2. As of the NVD publication date, no patch is available, and the Bugzilla disclosure deadline is set for 2026-07-18.

Keycloak is an open-source Identity and Access Management platform maintained by Red Hat. It provides SSO, OAuth 2.0/OIDC, user federation, and fine-grained administrative permissions. It serves over 6,500 customers globally and holds approximately 1.64% of the IAM market, ranking #8 among IAM vendors according to 6sense. Keycloak is widely adopted in enterprise environments, particularly in the United States (44.07% of deployments) and Germany (12.24%), so this vulnerability has a broad potential blast radius.

Technical Information

Root Cause: A Single Coarse Check Where Granular Enforcement Is Required

The vulnerability is in the partialImport method in RealmAdminResource.java. When a request arrives at POST /admin/realms/{realm}/partialImport, the method performs a single authorization check: auth.realm().requireManageRealm(). If the calling administrator holds the manage-realm role, this check passes unconditionally.

After that, the method processes the entire import payload without any per-resource-type FGAP permission checks. Keycloak's Fine Grained Admin Permissions system is designed to scope administrative actions to specific resource types (users, roles, clients, etc.) and so enforce the principle of least privilege. An administrator might hold manage-realm but be explicitly denied the ability to manage users or assign roles. The partialImport endpoint ignores all of these granular restrictions.

The flaw is classified as CWE-863 (Incorrect Authorization). CWE-863 applies when an authorization check is performed but is insufficient, as opposed to CWE-285 (Improper Authorization), where checks are missing entirely. Keycloak does check authorization, but it checks the wrong thing.

Attack Flow

Exploitation is straightforward and requires no specialized tooling:

1. The attacker needs an account that holds the manage-realm role but is restricted by FGAP policies from managing users or assigning roles. This is a common configuration in organizations that use FGAP to delegate specific administrative tasks.
2. They build a JSON payload for the partialImport endpoint that defines a user, either a new account or an existing one, with realm-admin role mappings included in the user definition.
3. They send the payload in a single POST request to /admin/realms/{realm}/partialImport. Nothing more is needed.
4. The endpoint evaluates requireManageRealm(), which passes because the attacker holds manage-realm. No FGAP checks run on the imported user's role mappings.
5. The imported user now holds realm-admin privileges. If the attacker imported their own account with these mappings, they have full administrative control over the realm, including access to all user data, authentication configurations, client secrets, and identity flows.

The partialImport Endpoint's Troubled History

The partialImport endpoint has other documented flaws. GitHub issue #36408 reported that the endpoint could remove existing user credentials during import. Issue #15554 documented behavioral inconsistencies between the UI and API calls for partial import. Taken together, these issues suggest the endpoint has received less security scrutiny than other parts of the admin REST API.

Systemic FGAP Weakness Pattern

CVE-2026-11577 is the third distinct FGAP bypass in Keycloak disclosed within approximately a year:

All three involve the org.keycloak:keycloak-services Maven package, which handles authorization decisions in the admin REST API. That pattern suggests an architectural weakness in how FGAP permissions are enforced across API endpoints, rather than a set of isolated implementation bugs.

Affected Systems and Versions

The vulnerability has been verified against Keycloak 26.6.1. The underlying behavior was first reported against Keycloak 16.1.0 in January 2022, and the root cause (a single requireManageRealm() check without per-resource-type FGAP enforcement) has persisted since then. The window of exposure may therefore span all versions from at least 16.1.0 through the current release.

As of 2026-06-08, the following recent Keycloak releases do not address this CVE:

• Keycloak 26.6.2 (released May 19, 2026)
• Keycloak 26.5.7 (released April 2, 2026)
• Keycloak 26.5.0 (released January 2026)

The Red Hat build of Keycloak is also affected. Recent Red Hat Security Advisories RHSA-2026:6478 (covering version 26.4.11) and RHSA-2026:2366 (covering version 26.4.9) do not address this CVE.

Any organization that uses FGAP to restrict administrative access in Keycloak, on any version, should consider itself potentially affected.

Vendor Security History

Keycloak has had a significant number of security vulnerabilities in recent years, and authorization and privilege escalation flaws recur among them:

CVE-2025-7784 (the FGAPv2 admin console bypass) was disclosed and patched within the same release cycle, with fixes in versions 26.2.6 and 26.3.0. So the Keycloak team can respond quickly when a vulnerability is recognized as one from the start. CVE-2026-11577 shows how framing a security issue as "hardening" rather than "vulnerability" can delay the entire response by years.

Overall, Red Hat has kept a reasonably active patch cadence, shipping security releases for the commercially supported Red Hat build of Keycloak through the standard RHSA process.

References

• NVD: CVE-2026-11577
• Red Hat CVE Page: CVE-2026-11577
• Bugzilla: 2459993 (CVE-2026-11577)
• GitHub Issue #9387: Hardening of manage-realm role
• GHSA-27gp-8389-hm4w: Privilege Escalation in Keycloak Admin Console (FGAPv2)
• GHSA-83j7-mhw9-388w: Keycloak FGAPv2 Admin PrivEsc
• GitLab Advisory: CVE-2025-7784 in keycloak-services
• CWE-863: Incorrect Authorization
• Keycloak Releases
• Keycloak 26.5.7 Release Notes
• RHSA-2026:6478 Security Advisory
• RHSA-2026:2366 Security Advisory
• Red Hat build of Keycloak
• Keycloak Market Share (6sense)
• CISA Known Exploited Vulnerabilities Catalog
• GitHub Issue #36408: Partial Import removed existing user credentials
• GitHub Issue #15554: PartialImport API behavioral inconsistencies