CVE-2026-14614
published 2026-07-03CVE-2026-14614: A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a…
PriorityP433medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.32%
23.2th percentile
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk | keycloak-rhel9 | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled.
ghsa_unreviewed·2026-07-03
CVE-2026-14614 [MEDIUM] A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled.
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
VulDB
Keycloak on Red Hat ClientResource permission (EUVD-2026-41556)
vuldb·2026-07-03·CVSS 5.4
CVE-2026-14614 [MEDIUM] Keycloak on Red Hat ClientResource permission (EUVD-2026-41556)
A vulnerability was found in Keycloak on Red Hat. It has been classified as critical. The affected element is an unknown function of the component ClientResource. This manipulation causes permission issues.
The identification of this vulnerability is CVE-2026-14614. It is possible to initiate the attack remotely. There is no exploit available.
Red Hat
keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
vendor_redhat·2026-07-03·CVSS 5.4
CVE-2026-14614 [MEDIUM] keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-14614 keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
bugzilla·2026-07-03·CVSS 5.4
CVE-2026-14614 [MEDIUM] CVE-2026-14614 keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
CVE-2026-14614 keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource
A write-path authorization bypass vulnerability exists in the ClientResource.addDefaultClientScope() and related endpoints in Keycloak when adminPermissionsEnabled is set to true (FGAP v2). The flaw stems from insufficient permission validation: the code only verifies that the caller has manage permissions on the target client but fails to check if the caller has any permissions (such as view or map) on the client scope being attached.
An attacker with a delegated admin role (Clients:view and Clients:manage on at least one client) can exploit this by discovering the UUID of a "hidden" client scope (one they are otherwise restricted from accessing). By calling the client scope ass
Bugzilla
CVE-2026-53314 kernel: padata: Put CPU offline callback in ONLINE section to allow failure
bugzilla·2026-06-26
CVE-2026-53314 [LOW] CVE-2026-53314 kernel: padata: Put CPU offline callback in ONLINE section to allow failure
CVE-2026-53314 kernel: padata: Put CPU offline callback in ONLINE section to allow failure
In the Linux kernel, the following vulnerability has been resolved:
padata: Put CPU offline callback in ONLINE section to allow failure
syzbot reported the following warning:
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")
which tglx traced to padata_cpu_dead() given it's the only
sub-CPUHP_TEARDOWN_CPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU
so move the CPU offline callback to the ONLINE section where failure is
possible.
Discussion:
Upstrea
2026-07-03
Published