CVE-2026-94213

Executive Summary

CVE-2026-94213 is an authorization flaw in the Authorization Services component of Keycloak, an open-source identity and access management (IAM) solution. The vulnerability resides in the policy evaluation endpoint, which administrators use to test how access policies apply to specific users. Due to missing authorization checks (CWE-862), a delegated administrator holding only limited viewing privileges can retrieve the full profile and role information of any user in the realm — including data they are explicitly not permitted to view, such as email addresses and assigned security roles. The CVSS v3.1 score is 4.9 (Medium), reflecting a network-accessible, authenticated attack requiring high privileges, with high confidentiality impact and no integrity or availability impact. As of this report, no patch, workaround, PoC, or exploit code is publicly available, and the vulnerability has not been added to CISA KEV or scored by FIRST.org EPSS.

Technical Analysis

The vulnerability is classified as CWE-862: Missing Authorization. This weakness class occurs when a software component does not perform (or incorrectly performs) an authorization check on a resource before allowing access to it. In this instance, the affected resource is the policy evaluation endpoint within Keycloak's Authorization Services component.

Keycloak's Authorization Services allow administrators to define fine-grained access policies on protected resources. The policy evaluation endpoint is a diagnostic/administrative feature used to test how those policies evaluate for a specific user — effectively answering the question "what access would this user have under the current policy set?" Because the endpoint's purpose is to simulate policy outcomes for arbitrary users, it must resolve and return user attributes (profile data, role assignments, group memberships) as inputs to policy evaluation.

The flaw is that this endpoint does not enforce authorization checks consistent with the caller's own permissions. A delegated administrator — a restricted administrative account granted a subset of realm administration capabilities, such as "view users" scoped to a limited set, or a view role granted for administrative convenience — can invoke the policy evaluation endpoint and receive the full profile and role information of any user in the realm. The authorization check that would normally gate access to another user's details (as enforced elsewhere in the administrative console or Admin REST API) is absent or insufficient at this specific endpoint.

The attack surface is the network-exposed administrative interface of Keycloak. The CVSS vector reflects this precisely: AV:N (network), AC:L (low complexity), PR:H (high privileges required — the attacker must already hold a delegated administrative role), UI:N (no user interaction), S:U (scope unchanged), C:H (high confidentiality impact), I:N (no integrity impact), A:N (no availability impact). The C:H subscore is directly attributable to the exposure of email addresses and role information described in the NVD text. The PR:H requirement substantially constrains the threat model: this is a privilege-escalation-of-information vulnerability relevant primarily to insider threats, compromised low-privilege administrative accounts, and delegated-administration delegation models where trust boundaries are assumed to be enforced.

No code-level specifics (function names, class names, HTTP paths, parameter names) are available from the provided NVD description, and none are invented here. The description does not state which Keycloak versions are affected, nor does it provide a commit reference or CVE-to-patch mapping.

Exploitation Scenarios

No public PoC is available for CVE-2026-94213; the attack chain below is inferred from the vulnerability class (CWE-862, missing authorization) and the NVD description. No specific function names, endpoints, or parameters beyond "policy evaluation endpoint" are asserted.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment with Authorization Services enabled. Keycloak admin consoles are frequently internet-exposed, and Shodan queries such as http.title:"Keycloak" or http.html:"keycloak" can enumerate candidate deployments. The attacker must already possess credentials for a delegated administrative account with limited viewing privileges — for example, an account created for helpdesk staff, a regional administrator, or a partner-scoped realm administrator. Such accounts are common in multi-tenant or delegated-administration deployments.

2. Triggering the flaw. The attacker authenticates to the Keycloak administrative interface with the delegated account. Because the policy evaluation endpoint lacks an authorization check against the caller's own permissions, the attacker can reach an operation that resolves user attributes for an arbitrary target user. The missing check means the endpoint returns data regardless of whether the caller holds the "view users" permission for that target, or is restricted to a subset of users.

3. Payload / execution method. At the vulnerability-class level, exploitation consists of issuing a request to the policy evaluation functionality that specifies a target user, causing the backend to resolve and return that user's profile and role data as part of policy evaluation output. No payload injection, memory corruption, or code execution is involved — the "payload" is simply a legitimate request to an improperly authorized endpoint, using a valid session. This fact is why the attack leaves conventional web-exploitation signatures (injection strings, traversal sequences) absent and why detection must rely on behavioral and access-pattern analytics rather than signature matching.

4. Post-exploitation impact. The attacker obtains email addresses and assigned security roles for arbitrary users in the realm. This information is directly enabling: email addresses feed phishing and credential-stuffing campaigns, while role assignments reveal which accounts hold privileged access (e.g., realm-admin, cluster-admin equivalent roles, service accounts). The attacker can map the organization's privileged identity surface, identify high-value targets for subsequent phishing or credential attacks, and — because role information exposes the delegation model — identify further delegated administrator accounts to compromise in a widening chain. Because the impact is read-only (I:N, A:N), the attacker leaves no mutation of state; the activity can persist undetected indefinitely if administrative access logs are not reviewed for anomalies in policy evaluation usage.

Impact Assessment

The business impact is a confidentiality breach of identity data. Keycloak is typically deployed as the central authentication and authorization provider for an enterprise — single sign-on for internal applications, customer identity for external-facing services, and increasingly as the identity plane for Kubernetes and API gateways. As such, the user profiles and role assignments held within it are high-value metadata: they map human identities to organizational privileges.

CVSS subscores (v3.1, 4.9 Medium / Base): AV:N — remotely reachable; AC:L — no special conditions; PR:H — attacker must hold delegated administrative credentials; UI:N — no victim interaction; S:U — impact stays within the security authority of the vulnerable component; C:H — full profile and role data of arbitrary users is exposed; I:N — no data modification; A:N — no service disruption. The PR:H rating is the primary reason the score lands in Medium territory despite the C:H impact; however, in delegated-administration deployments, a large population of helpdesk and scoped-admin accounts may each qualify as "high privileges," expanding the practical attacker pool beyond a handful of super-admins.

Blast radius: every user in the affected realm whose profile is resolvable by the policy evaluation endpoint — potentially the entire tenant population. Affected systems are any Keycloak deployment with Authorization Services enabled and with delegated administrative accounts provisioned. There is no evidence of active exploitation in the wild, no CISA KEV listing, and no EPSS score at the time of writing; the practical risk is therefore elevated primarily for organizations with broad delegated-admin models, insider-threat exposure, or internet-exposed admin consoles.

Detection Guidance

Detection must focus on anomalous use of the policy evaluation functionality by accounts that do not normally perform policy testing, and on correlation of those events with subsequent user-enumeration or exfiltration behavior. Because the attack uses valid credentials and a legitimate endpoint, behavioral baselines are essential.

Sigma Rule

title: Keycloak Policy Evaluation Endpoint Abuse by Low-Privilege Delegated Admin
id: 8d3f1c2a-9421-4e5b-9a7c-6b1e2f5a4c30
status: experimental
description: Detects access to the Keycloak Authorization Services policy evaluation endpoint by accounts that do not hold full realm-admin privileges, consistent with CVE-2026-94213 missing authorization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94213
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_endpoint:
    operation|contains:
      - 'policy-evaluation'
      - 'policy evaluation'
  selection_actor_type:
    actorType: 'ADMIN'
  filter_known_admins:
    actorId|startswith:
      - 'service-account-'
  condition: selection_endpoint and selection_actor_type and not filter_known_admins
falsepositives:
  - Legitimate policy testing by authorized realm administrators
  - Automated configuration validation tooling
level: medium
tags:
  - attack.t1078
  - cve.2026.94213

YARA Rule

rule CVE_2026_94213_Keycloak_Policy_Eval_Abuse
{
    meta:
        description = "Detects HTTP requests targeting the Keycloak policy evaluation endpoint outside normal admin usage patterns (CVE-2026-94213)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94213"
        cve = "CVE-2026-94213"

    strings:
        $p1 = "policy-evaluation" ascii nocase
        $p2 = "policy/evaluate" ascii nocase
        $authz = "/authz/" ascii nocase
        $realm = "/admin/realms/" ascii nocase

    condition:
        (uint16(0) == 0x4854 or true) and
        any of ($p*) and ($authz or $realm)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94213 Keycloak Authorization Services policy evaluation endpoint access - possible missing authorization abuse"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; content:"/authz/"; http.uri; content:"policy"; content:"evaluation" nocase; http.uri; content:"/admin/realms/"; classtype:attempted-recon; reference:cve,2026-94213; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94213; sid:202694213; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.outcome == "success" and keycloak.realm.name : * ]
  [ any where event.action : "POLICY_EVALUATION" or url.path : *policy*evaluation* ]
  [ any where event.action : ("VIEW_USER" or "QUERY_USERS" or "GET_USER") ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:admin_events operation=*policy*evaluation*
| stats count values(target_user) as enumerated_users by actorId, actorUsername, src_ip
| where count > 5 OR mvcount(enumerated_users) > 10
| lookup delegated_admin_allowlist actorId OUTPUT is_authorized
| where isnull(is_authorized) OR is_authorized!="true"
| table _time, actorUsername, src_ip, count, enumerated_users

Wazuh OSSEC Rule

<group name="keycloak,access_control,">
  <rule id="2026942" level="10">
    <decoded_as>json</decoded_as>
    <field name="operation">\.?policy.?evaluation</field>
    <field name="actorType">ADMIN</field>
    <description>CVE-2026-94213: Keycloak policy evaluation endpoint accessed by delegated admin - possible unauthorized user data disclosure</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_94213,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix, workaround, affected-version list, or OSV package data was provided. The following guidance is derived from the vulnerability class (CWE-862 missing authorization) and should be validated against any future vendor advisory.

1. Immediate mitigations.

   • Restrict network access to the Keycloak administrative interface. The admin console and Admin REST API should never be internet-exposed; place them behind a management VPN, a zero-trust access proxy, or IP allowlisting. This removes the AV:N exposure path entirely for external attackers and confines the residual risk to insiders and already-compromised internal hosts.
   • Audit and minimize delegated administrative accounts. Enumerate every account holding restricted admin roles (helpdesk, regional, partner-scoped), verify each is still required, and revoke any that are not. Because the flaw is triggered by delegated admins, shrinking that population directly shrinks the attacker pool.
   • Monitor and, where feasible, temporarily restrict or disable access to Authorization Services policy evaluation functionality for non-super-admin roles until a patch is available. If the deployment does not use Authorization Services policy testing in routine operations, disabling Authorization Services for affected realms removes the vulnerable attack surface.
   • Enable and centrally ship Keycloak admin event logging. Forward admin-events to the SIEM and baseline which accounts invoke policy evaluation. Any invocation by a delegated (non-super) admin is a high-fidelity signal under this CVE.

2. Patch / upgrade steps. No patch is available as of this report. Track the vendor's Keycloak security advisories and release notes for the version that remediates CVE-2026-94213. The correct fix is expected to enforce an authorization check on the policy evaluation endpoint, ensuring the caller holds the permission required to view the target user's details (for example, the corresponding view-users permission scoped to the target). When a patched version is released, upgrade immediately, then re-verify that delegated-admin roles no longer can retrieve unauthorized user profiles. Do not assume a version boundary without vendor confirmation, as no affected-version data is available.

3. Long-term hardening.

   • Adopt least-privilege design for all Keycloak administrative roles; treat delegated administration as a controlled, reviewed delegation with periodic recertification.
   • Enforce defense-in-depth on the identity plane: network segmentation for admin surfaces, mandatory MFA for all administrative accounts, and short-lived credentials for service accounts.
   • Implement continuous authorization testing in CI/CD or periodic security review of administrative endpoints, since missing-authorization flaws (CWE-862) recur across features.
   • Deploy behavioral analytics that alert on any administrative account accessing user data outside its historical pattern, not only on this specific endpoint, to catch similar CWE-862 variants.

References

• NVD — CVE-2026-94213: https://nvd.nist.gov/vuln/detail/CVE-2026-94213
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Keycloak project security advisories: https://www.keycloak.org/security
• Red Hat Product Security (Keycloak upstream maintainer) advisories: https://access.redhat.com/security/
• FIRST.org EPSS (not yet scored for this CVE at time of writing): https://www.first.org/epss/

No CISA KEV listing, no public PoC, no exploit code, and no known threat actor campaign or exploit-in-the-wild evidence were available at the time of this report.