CVE-2026-94215

Executive Summary

CVE-2026-94215 is an authorization flaw (CWE-862, Missing Authorization) in the Admin REST API of Keycloak, an open-source identity and access management solution. The API resolves clients by their unique identifier using a per-request in-memory cache without verifying that the resolved client belongs to the realm named in the request path. A realm administrator with limited privileges can therefore read or modify client configuration objects that belong to the master realm by addressing them through a realm they control, leading to exposure of client credentials or redirection of administrative login flows to attacker-controlled sites. CVSS v3.1 score is 5.5 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L); no public exploit, Nuclei template, or CISA KEV listing exists at the time of writing.

Technical Analysis

Keycloak structures its administrative interface around realms. Each realm is an isolated namespace containing users, groups, roles, clients, and identity provider configurations. The Admin REST API exposes realm-scoped endpoints, meaning an administrator authenticated against realm A is expected to be able to manipulate only objects owned by realm A. Realm ownership is normally enforced by resolving the requested object within the scope of the realm identified in the request path and rejecting any object whose owning realm does not match.

The flaw described in the NVD entry is a scope-confusion defect in that resolution logic. When the Admin REST API resolves a client by its unique client identifier, it uses a per-request in-memory cache. The cache is keyed by the unique identifier alone and does not incorporate the realm bound to the request path. As a result, the authorization check that should confirm "this client belongs to the realm I am addressing" is skipped or defeated: the cached client object, which may belong to the master realm, is returned to a caller operating inside a different, lower-privileged realm.

Two properties make this exploitable:

1. Trust boundary collapse. The realm path segment is the primary tenant isolation primitive in Keycloak's administrative model. A per-request cache that omits realm from its key effectively flattens that boundary for object lookups, so the security decision is made on object identity alone rather than object identity plus ownership.

2. Privilege asymmetry. The master realm is the administrative root of a Keycloak deployment: it hosts the administrative clients, including those used by the admin console and the account console, and is typically the realm that controls management of all other realms. A delegated realm administrator who controls only a subordinate realm would not normally be authorized to read or write master-realm client configuration.

Because the defect permits both read and write access to client configuration objects, the integrity impact is rated High (I:H) while confidentiality is rated Low (C:L) and availability Low (A:L). The remote attack vector (AV:N) combined with High attack complexity (AC:H) and High privileges required (PR:H) yields the 5.5 base score: the attacker must already hold valid administrative credentials in some realm and must satisfy the cache conditions that cause the cross-realm resolution to occur, but the resulting exposure is a full tenant-isolation break for the targeted client objects.

The precise code path, class names, and cache implementation are not disclosed in the available intelligence. No function names, endpoints, parameter names, or file paths beyond "Admin REST API" are provided by the NVD description, and none are inferred here. The vulnerability class is best characterized as a missing authorization check caused by insufficient scoping of a cached object lookup — a "confused deputy" pattern in which the request handler acts on behalf of the caller using an object the caller should not be able to reach.

Key attributes:

• CWE: CWE-862 (Missing Authorization) — the code does not perform the ownership authorization check at all in the affected path.
• Auth requirements: Attacker needs administrative privileges in at least one non-master realm (PR:H).
• Complexity: AC:H — exploitation depends on the cache behavior being reachable and on the attacker holding the required administrative role in a realm that can be used as the access path.
• User interaction: None required (UI:N).
• Scope: Unchanged (S:U) — the impact is scored within Keycloak's security authority, though logically it crosses a realm boundary.

There is currently no vendor advisory, affected version list, commit reference, or OSV package record attached to this CVE in the data provided. The vulnerability should be treated as unpatched pending vendor confirmation.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-94215 as of this report. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific endpoint paths, request bodies, or parameter names are asserted, because none are provided.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment and determines which realms exist and which realm their administrative account can manage. Keycloak deployments commonly expose a well-known administrative interface, so a low-privileged realm administrator (for example, an operator granted administrative rights over a subordinate tenant realm) is the realistic starting position. The attacker maps client identifiers known or guessed to belong to the master realm, since client identifiers must be resolvable for the flaw to be triggered.

2. Triggering the flaw class. The attacker issues an authenticated request to the Admin REST API addressed to a realm they control, referencing a client identifier that actually belongs to the master realm. Because the API resolves clients by unique identifier through the per-request in-memory cache without checking that the resolved client is owned by the realm in the request path, the request is not rejected by the realm-ownership authorization check. The authorization boundary that should compare "requested realm" against "client's owning realm" is missing (CWE-862).

3. Payload / execution method. At the class level, the attacker performs an ordinary Admin REST API operation — read or update — against a client configuration object. The "payload" is not code but a crafted administrative request: the realm path segment points to a realm the attacker controls, while the client reference resolves, through the unscoped cache, to a master-realm client. No injection, deserialization, or memory-corruption primitive is involved. The vulnerability is purely an authorization logic failure.

4. Post-exploitation impact. Successful read access discloses sensitive client configuration from the master realm, potentially including client credentials (e.g., client secrets) for master-realm clients. Successful write access allows modification of those client configurations. Per the NVD description, a concrete high-value outcome is the redirection of administrative login attempts to malicious sites: if a master-realm client used during the administrative authentication flow can be modified, the login flow can be pointed at attacker infrastructure, enabling credential phishing of Keycloak administrators and escalation from a limited realm administrator to compromise of the management plane.

Two distinguishing features of this chain deserve emphasis for defenders:

• It is an authenticated, low-noise abuse of legitimate API functionality, not a remotely unauthenticated exploit. It will look like normal admin API traffic unless realm/client ownership mismatches are specifically logged and correlated.
• It requires no user interaction, so the phishing element arises only if the attacker elects to harvest credentials via a redirected login flow rather than simply reading or altering configuration directly.

Impact Assessment

The primary impact is a breach of multi-tenant isolation in Keycloak's administrative plane. Deployments that use realms as security boundaries — MSSPs hosting customer realms, enterprises separating business units or environments (production vs. non-production) into distinct realms, or any architecture where "realm administrator" is a deliberately limited delegation — are directly affected. In such deployments, an administrator who is supposed to be confined to one realm can reach into the master realm.

Subscore interpretation:

• Confidentiality (C:L): the flaw provides read access to client configuration; the description calls out exposure of client credentials, which may permit further lateral movement, but the breadth is bounded by which client objects can be resolved and read.
• Integrity (I:H): the most severe component. Modification of master-realm client configuration is a high-integrity impact. Redirecting administrative login attempts to malicious sites can compromise administrator credentials, effectively handing over the management plane.
• Availability (A:L): misconfiguration or breaking of client configuration could disrupt authentication services for the affected realm, but the description does not establish a broad denial-of-service capability.
• Attack Vector (AV:N), Attack Complexity (AC:H), Privileges Required (PR:H), User Interaction (UI:N), Scope (S:U).

Business consequences include:

• Credential exposure: client secrets from the master realm can be used to impersonate trusted clients and obtain tokens through client-credentials flows.
• Administrative account takeover: redirection of admin logins enables harvesting of high-value Keycloak administrator credentials, the "keys to the kingdom" for any application federated to the deployment.
• Regulatory and contractual exposure: realm isolation is frequently relied upon as a data-separation control; its failure may constitute a reportable security incident under customer contracts or compliance frameworks.
• Blast radius: all applications, identity federations, and single sign-on integrations that trust the affected Keycloak deployment should be considered in scope for post-compromise review, because the master realm governs them.

Exploitation is not trivial — it requires administrative credentials in some realm and favorable cache conditions — which is why the base score sits in the medium band. However, the consequence of success is disproportionate to the score, and the absence of a patch raises risk over time.

Detection Guidance

Detection should focus on realm/client ownership mismatches in Admin REST API activity and on post-exploitation indicators such as master-realm client configuration changes or admin login redirection. Because no endpoint paths, parameter names, or log formats are specified in the provided intelligence, the rules below key on general, observable patterns (HTTP admin API access, realm-path structure, and Keycloak audit events) rather than on invented field names. Analysts should tune field names to their Keycloak logging schema.

Sigma Rule

title: Potential Keycloak Admin REST API Cross-Realm Client Access (CVE-2026-94215)
id: 8f2c4a71-3b9e-4c5d-9a10-keycloak-xrealm-0001
status: experimental
description: Detects administrative HTTP requests where the realm in the request path may not match the owning realm of the referenced client, consistent with CWE-862 scope-confusion abuse in the Keycloak Admin REST API.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94215
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.94215
logsource:
  category: webserver
  product: keycloak
detection:
  selection_admin:
    cs-uri-stem|contains:
      - '/admin/realms/'
  selection_sensitive_realm:
    cs-uri-stem|contains:
      - '/clients'
  selection_master_ref:
    cs-uri-query|contains|all:
      - 'master'
  filter_expected:
    cs-username|contains:
      - 'admin'
  condition: selection_admin and selection_sensitive_realm and selection_master_ref and not filter_expected
falsepositives:
  - Legitimate master-realm administrators managing master-realm clients
  - Automated provisioning systems with cross-realm tooling
level: medium

YARA Rule

rule CVE_2026_94215_Keycloak_XRealm_Admin_Request
{
    meta:
        description = "Detects HTTP request artifacts consistent with cross-realm client resolution abuse in the Keycloak Admin REST API (CVE-2026-94215)."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94215"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "/admin/realms/" ascii wide nocase
        $b = "/clients" ascii wide nocase
        $c = "master" ascii wide nocase
        $d = "Keycloak" ascii wide nocase

    condition:
        uint32be(0) < 0x10000 and
        filesize < 1MB and
        $a and $b and $c and $d
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94215 Possible Keycloak Admin REST API Cross-Realm Client Access"; flow:established,to_server; http.method; content:"GET" or content:"PUT" or content:"POST"; http.uri; content:"/admin/realms/"; http.uri; content:"/clients"; http.uri; pcre:"/\/admin\/realms\/[^\/]+\/clients[^?]*(\?|$)/i"; classtype:attempted-admin; sid:2026942151; rev:1; metadata:cve 2026-94215, cwe 862, created_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where network.protocol == "http"
      and url.path : "/admin/realms/*/clients*"
      and url.query : "master" ]
  [ network where network.protocol == "http"
      and url.path : "/admin/realms/*/clients/*"
      and http.request.method in ("PUT", "POST", "PATCH") ]

Splunk SPL Query

index=web sourcetype=keycloak_access
| search uri_path="/admin/realms/*/clients*"
| eval requested_realm = mvindex(split(uri_path, "/"), 3)
| where requested_realm != "master"
| search uri_query="*master*" OR uri_path="*master*"
| stats count min(_time) as first_seen max(_time) as last_seen values(http_method) as methods values(status) as status_codes by src_ip, user, requested_realm, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,web,accesslog,">
  <rule id="2026942" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/admin/realms/</field>
    <field name="url">/clients</field>
    <description>CVE-2026-94215: Possible Keycloak Admin REST API cross-realm client access attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_94215,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, workaround, or affected-version list is available in the provided intelligence. The following measures are compensating controls, not vendor-endorsed remediations.

1. Immediate mitigations

   • Minimize the number of accounts holding administrative privileges in any non-master realm. Realm isolation is the control this flaw defeats, so reduce reliance on delegated realm administration until a fix is confirmed.
   • Audit the administrative role assignments in every realm and revoke delegated admin rights that are not strictly required.
   • Restrict network access to the Keycloak Admin REST API and admin console to trusted management networks or a VPN; the flaw requires authenticated admin access, so attack surface reduction directly limits exposure.
   • Enable and centralize Keycloak administrative audit logging (admin events) and monitor for client configuration changes in the master realm that were not made by known master-realm administrators.
   • Rotate client secrets for master-realm clients as a precaution if cross-realm access is suspected, since the flaw can expose client credentials.

2. Patch / upgrade steps

   • No patch is currently available. Monitor the official Keycloak release notes, security advisories, and the NVD record for CVE-2026-94215 for a fixed version.
   • When a vendor fix is released, schedule emergency change-managed upgrades, beginning with internet-exposed deployments and multi-tenant installations where realms serve as trust boundaries.
   • After upgrading, re-validate that realm-scoped administrative operations cannot resolve objects outside the request's realm.

3. Long-term hardening

   • Treat every realm as a tenant boundary and enforce minimum-privilege administrative delegation; do not grant a single account administrative rights across multiple realms unless operationally required.
   • Adopt continuous configuration monitoring for the master realm and alert on any client changes, especially changes to redirect URIs or flows used by administrative authentication.
   • Include identity-provider components (Keycloak, and any comparable IAM platform) in routine authorization-logic review and regression testing for cross-tenant access.
   • Implement defense-in-depth for administrative authentication, such as phishing-resistant MFA and strict redirect-URI allow-listing, to blunt login-redirection attacks enabled by this flaw.

References

• NVD — CVE-2026-94215: https://nvd.nist.gov/vuln/detail/CVE-2026-94215
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1078: Valid Accounts — https://attack.mitre.org/techniques/T1078/
• Keycloak project — security and release advisories: https://www.keycloak.org/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-94215 is not listed; status: NO)

No threat actor campaign, exploit-in-the-wild evidence, public PoC, exploit code, or Nuclei template is associated with CVE-2026-94215 in the available intelligence.