CVE-2026-16106: redhat build_of_keycloak
Vulnerability summary
CVE-2026-16106 is a medium (CVSS 4.9) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.
Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1220Insufficient Granularity of Access ControlThe product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Redhat1 product
1 vendor · 1 product