Threat Intelligence Report: CVE-2026-94000

Executive Summary

CVE-2026-94000 is a missing-authorization flaw (CWE-862) in the Admin REST API of Keycloak, the widely deployed open-source identity and access management (IAM) solution. The defect resides in the group-membership endpoints, which fail to verify whether a target group confers administrative privileges before permitting a user to be added to it. This permits a delegated administrator holding only limited, scoped permissions to add their own account to a high-privilege group, escalating to realm-wide administrative control.

The vulnerability carries a CVSS v3.1 base score of 6.6 (Medium) and is currently UNPATCHED across all tracked sources. No public proof-of-concept, exploit code, or Nuclei template exists. EPSS has not yet scored this CVE. It is not listed in CISA KEV. Organizations running Keycloak with delegated-admin models and multi-tier group structures are exposed.

Technical Analysis

Keycloak's authorization model permits a realm administrator to delegate narrowly scoped administrative rights to subordinate ("delegated") administrators. These delegated administrators are intended to manage only a defined subset of users, groups, or clients. The security boundary of this model depends on the server enforcing that a delegated administrator can never acquire more privilege than was granted.

CVE-2026-94000 breaks that invariant. According to the NVD description, the failure occurs in the group-membership endpoints of the Admin REST API. When a user is added to a group, the system is supposed to evaluate whether that group grants administrative privileges (i.e., whether membership in the group confers elevated rights). The description states the system "fails to check if a group grants administrative privileges before allowing a user to be added."

Because this check is absent, the authorization decision for the add-member operation does not account for the privilege level of the destination group. A delegated administrator with limited permissions can therefore perform a group-membership write operation targeting a group that, by design, should be off-limits to them. The result is privilege escalation from a constrained administrative scope to a high-privilege group, and "potentially gaining full control over the entire realm."

Root cause class: CWE-862 — Missing Authorization. This is a classic object-level authorization gap (often described in API security as Broken Object Level Authorization, BOLA/BOPLA), where the endpoint authenticates the caller and confirms they hold some admin role, but does not confirm they are authorized for this specific target group.

Attack surface: the Admin REST API's group-membership operations. The description does not enumerate specific endpoint paths, HTTP methods, or request parameters, so those are intentionally not reproduced here. What can be stated from the source data:

• The vulnerable functionality is server-side (Keycloak's admin layer).
• It is reachable over the network by an authenticated principal (AV:N, PR:H).
• Exploitation requires the attacker to already possess some delegated administrative privileges (PR:H) and requires conditions that make reliable exploitation non-trivial (AC:H).

No code-level artifacts (function names, class names, file paths) are provided in the NVD description and none are fabricated in this report. The mechanism is described at the vulnerability-class level.

The High attack complexity (AC:H) reflects that successfully weaponizing the flaw likely depends on specific realm configuration: the existence of a delegated-admin role with permission to invoke the group-membership operation, and a high-privilege group that the delegated admin can name as a target. The High privileges-required (PR:H) reflects that the attacker is not anonymous—they must already be an authenticated administrator of some tier.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authorization on a group-membership write) and the NVD description. No specific endpoint paths, parameters, or function names are invented.

1) Reconnaissance / target identification The attacker holds a delegated administrator account within a Keycloak realm. Using their legitimate, limited admin access, they enumerate groups and roles to identify a group whose membership confers administrative privileges (a "high-privilege group"). They also confirm they can reach the Admin REST API group-membership functionality. Typical targets are realms that rely on delegated administration—helpdesk admins, tenant-scoped admins, or application owners given partial control.

2) Triggering the flaw class The attacker issues a group-membership write request through the Admin REST API, adding their own user to the identified high-privilege group. The server authenticates the caller and verifies they hold a delegated-admin role, but—because of the missing authorization check—does not verify that the target group is one the delegated admin is permitted to manage, nor whether the group grants elevated privileges. The membership write succeeds where it should be denied.

3) Payload / execution method At the vulnerability-class level, the "payload" is the group-membership assignment itself: the attacker's identity is inserted into the privileged group. No malicious code or injection payload is required—the flaw is abused through a legitimate API operation being under-authorized. Because the attacker controls the target user identity (their own account), no additional preconditions beyond the delegated-admin session are needed.

4) Post-exploitation impact Once the attacker is a member of the high-privilege group, they inherit the rights that group grants. Per the NVD description this can yield "full control over the entire realm." Realistically this includes the ability to create or modify users, clients, roles, and—critically—to mint or alter identities and tokens, enabling lateral movement into every application that federates trust to Keycloak, and potential persistence via new admin accounts or credential/secret manipulation.

Impact Assessment

CVSS v3.1 base: 6.6 (Medium) — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

• Confidentiality: High — realm-wide control permits reading all identities, sessions, clients, and secrets managed by the realm.
• Integrity: High — an attacker with full realm control can alter users, groups, roles, clients, and protocol mappers.
• Availability: High — administrative access can disrupt authentication for all relying parties (e.g., disabling users, breaking authentication flows, or deleting clients).
• Scope: Unchanged — impact is contained within the Keycloak realm's security authority.
• Attack Vector: Network, Privileges Required: High (attacker must already be a delegated admin), Attack Complexity: High, User Interaction: None.

Blast radius: Any Keycloak realm that (a) uses delegated administration, and (b) maintains at least one group whose membership grants elevated privileges, is potentially vulnerable. Because Keycloak is a central identity provider, a compromised realm cascades to every downstream application performing SSO, OIDC, or SAML federation against it. The true business impact may exceed the numeric score: an IAM compromise is a "keys to the kingdom" event enabling downstream lateral movement, session hijack, and persistent trust abuse across an entire enterprise.

This is assessed as elevation of privilege rather than unauthenticated compromise: the attacker must bring existing delegated credentials. The strategic risk is therefore insider threat, compromised low-tier helpdesk credentials, or third-party/managed-service accounts with delegated rights.

Detection Guidance

Detection is challenging because exploitation uses legitimate admin API traffic. Focus on behavioral anomalies: a delegated admin assigning themselves (or unusual identities) to privileged groups.

Sigma Rule

title: Keycloak Delegated Admin Self-Addition to Privileged Group (CVE-2026-94000)
id: 7a1c9e42-94f0-4d3b-9c11-202694000aa1
status: experimental
description: Detects a delegated administrator adding a user to a group, consistent with abuse of missing authorization in Keycloak group-membership endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94000
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_action:
    operation: 'UPDATE'
    resourceType: 'GROUP_MEMBERSHIP'
  selection_self:
    - actorId|equalsfield: userId
    - details|contains: 'self'
  condition: selection_action and selection_self
fields:
  - actorId
  - userId
  - resourcePath
  - resourceType
  - ipAddress
falsepositives:
  - Legitimate self-service group enrollment where the group is non-privileged
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.94000

YARA Rule

rule CVE_2026_94000_Keycloak_GroupMembership_Abuse
{
    meta:
        description = "Heuristic detection of Keycloak admin group-membership abuse artifacts in API logs or exports"
        cve = "CVE-2026-94000"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94000"

    strings:
        $api1 = "/admin/realms/" ascii wide
        $grp1 = "/groups/" ascii wide
        $members = "members" ascii wide nocase
        $admin_evt = "GROUP_MEMBERSHIP" ascii wide
        $role_grant = "realm-admin" ascii wide nocase

    condition:
        filesize < 5MB and
        (($api1 and $grp1) or $admin_evt) and
        (any of ($members, $role_grant))
}

Note: This YARA rule is heuristic and keyed on generic Keycloak admin API and event tokens; it is intended for triage of exported logs/artifacts, not precise binary classification.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94000 Keycloak Admin REST API group-membership write"; flow:established,to_server; http.method; content:"POST" or content:"PUT"; http.uri; content:"/admin/realms/"; content:"/groups/"; http.uri; content:"/members"; classtype:attempted-admin; reference:cve,2026-94000; sid:2026940001; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_94000;)

The URI tokens above ("/admin/realms/", "/groups/", "/members") reflect the documented shape of Keycloak's Admin REST API group-membership surface; validate against your deployment before enabling at scale, as this rule will match legitimate administrative traffic.

Elastic Detection

sequence by user.id with maxspan=5m
  [ authentication where event.action == "login" and user.name != null ]
  [ any where
      event.category == "iam" and
      event.action in ("group-membership-add", "group-membership-update") and
      user.target.name == user.name ]

Logic: flag a session where the acting user adds their own identity to a group shortly after authenticating—the core abuse pattern for delegated-admin self-escalation.

Splunk SPL Query

index=keycloak sourcetype="keycloak:admin"
| search operation=UPDATE resourceType=GROUP_MEMBERSHIP
| eval self_add = if(actorId==userId, "SELF_ADDITION", "OTHER")
| where self_add="SELF_ADDITION"
| stats count values(resourcePath) as targets values(ipAddress) as src_ips by actorId userId
| where count >= 1
| sort - count

Tune resourcePath against known privileged groups. Repeated self-additions to high-privilege groups from a delegated admin are the strongest signal.

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-94000,">
  <rule id="2026940" level="0">
    <decoded_as>json</decoded_as>
    <field name="operation">UPDATE</field>
    <field name="resourceType">GROUP_MEMBERSHIP</field>
    <description>Keycloak group-membership update observed.</description>
  </rule>

  <rule id="2026941" level="12">
    <if_sid>2026940</if_sid>
    <field name="actorId">\.</field>
    <description>CVE-2026-94000: Possible delegated-admin self-addition to group (privilege escalation).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

actorId/userId parity checks should be enforced in the decoder or a follow-on rule; the above is a starting scaffold. Adjust field names to match your Keycloak JSON admin-event schema.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, tracked patch source, OSV package fix, or workaround is available from the provided intelligence. EPSS is unscored and the CVE is not in CISA KEV.

1) Immediate mitigations (compensating controls)

• Minimize delegated administrators. Audit every account holding delegated-admin roles and remove or downscope those that are not strictly required. This directly reduces the PR:H precondition.
• Constrain high-privilege groups. Identify groups whose membership confers administrative rights and restrict who may modify them.
• Network-restrict the Admin API. Limit access to the Admin REST API (and the admin console) to trusted management networks/VPNs; block public exposure.
• Centralize and alert on admin events. Enable Keycloak admin event logging and forward to your SIEM with the detections above; alert on any self-addition to privileged groups.
• Rotate and monitor delegated credentials. Treat delegated-admin credentials as high-value; enforce MFA and short session lifetimes.

2) Patch / upgrade steps

• No patch exists as of this report. Monitor the Keycloak project's security advisories and the NVD entry (CVE-2026-94000) for a vendor fix.
• When a patched release is published, upgrade promptly and re-validate that the group-membership endpoint enforces the missing authorization check.
• Because no fixed version is published, do not assume any specific release is safe.

3) Long-term hardening

• Adopt a least-privilege delegated-admin model with periodic access recertification.
• Implement object-level authorization tests in CI for admin API operations (target-group authorization).
• Treat the IAM platform as tier-0 infrastructure: isolate it, monitor it, and apply defense-in-depth.
• Establish a standing process to track Keycloak CVEs and reconcile against deployment versions.

References

1. NVD — CVE-2026-94000: https://nvd.nist.gov/vuln/detail/CVE-2026-94000
2. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. Keycloak project security advisories: https://www.keycloak.org/security
4. CVSS v3.1 Specification (FIRST.org): https://www.first.org/cvss/v3.1/specification-document
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94000 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None available. No public PoC, exploit code, Nuclei template, or campaign attribution exists for CVE-2026-94000 at the time of writing. Exploitation activity, if any, is not publicly reported.

Report generated by Valters IT Threat Intelligence. Analytical judgments on exploitation are inferred from the vulnerability class (CWE-862, missing authorization on group-membership writes) and the NVD description; no implementation-specific artifacts were fabricated. All detection rules are starting points requiring tuning against your environment.