CVE-2026-18570: Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed
Vulnerability summary
CVE-2026-18570 is a medium (CVSS 5.4) Missing Authorization vulnerability in redhat build_of_keycloak. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22% of scored vulnerabilities.
Timeline
- 02-08-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
Increase +0.13 pp
From 0.18% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat1 product
1 vendor · 1 product