CVE-2026-15572
published 2026-08-05CVE-2026-15572: A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which…
PriorityP359high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.65%
50.6th percentile
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.14 | 26.4.14 |
| redhat | build_of_keycloak | >= 26.6 < 26.6.5 | 26.6.5 |
| rhbk | keycloak-operator-bundle_26.4.14-1 | — | — |
| rhbk | keycloak-operator-bundle_26.6.5-1 | — | — |
| rhbk | keycloak-rhel9 | — | — |
| rhbk | keycloak-rhel9-operator_26.4-22 | — | — |
| rhbk | keycloak-rhel9-operator_26.6-11 | — | — |
| rhbk | keycloak-rhel9_26.4-22 | — | — |
| rhbk | keycloak-rhel9_26.6-11 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
vendor_redhat·2026-08-05·CVSS 8.8
CVE-2026-15572 [HIGH] CWE-843 keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
Statement: The Red Hat Product Security
GHSA
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.
ghsa_unreviewed·2026-08-05
CVE-2026-15572 [HIGH] CWE-843 A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management.
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
No detection rules found.
No public exploits indexed.
2026-08-05
Published