CVE-2026-96448

Executive Summary

CVE-2026-96448 is a privilege escalation flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The vulnerability allows a delegated administrator with limited permissions to assign a composite role that implicitly grants full administrative control, because the permission check does not inspect the nested permissions contained within composite roles. Successful exploitation results in complete management access over the affected Keycloak realm, with high impact to confidentiality, integrity, and availability.

Technical Analysis

The vulnerability resides in the authorization logic of Keycloak's Fine-Grained Admin Permissions (FGAP v2) subsystem. FGAP v2 is designed to allow realm administrators to delegate narrow administrative capabilities to non-privileged accounts — for example, granting a help-desk operator the ability to assign selected roles to users without granting them broader administrative authority.

The core defect is an improper authorization check (CWE-285). When a delegated administrator attempts to assign a role to a user, Keycloak validates whether the acting administrator holds permission to assign that specific role. However, the check evaluates only the role presented at the top level and does not recurse into the role's composite structure. In Keycloak, a composite role is a container that aggregates one or more child roles; assigning the composite role to a principal transitively grants every role it contains. Therefore, if an existing composite role bundles a low-privilege role together with a highly privileged role (such as a realm-management administrative role), the authorization check sees only the apparently benign composite and approves the assignment.

Because the permission validation is shallow rather than recursive, the effective privilege of the assigned role is never compared against the delegated administrator's own permission ceiling. The result is a classic privilege escalation via role chaining: a low-privilege administrative actor can reach the highest privilege tier in the realm by selecting the correct composite role.

The attack surface is the administrative role-assignment interface exposed by the FGAP v2 feature. The CVSS vector (AV:N/AC:H/PR:H/UI:N) indicates the flaw is network-reachable, requires high attack complexity (the attacker must identify or create a suitable composite role and possess a delegated account), and requires high privileges (a pre-existing delegated administrator account). No user interaction is needed. Scope is unchanged, while confidentiality, integrity, and availability impacts are all rated High, reflecting that a fully compromised realm exposes all identities, sessions, and configuration managed by that realm.

No affected version range, patch reference, or vendor advisory has been published in the provided intelligence. The specific Keycloak releases that ship FGAP v2 with the flawed check are therefore undetermined from available data.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-96448. The attack chain below is inferred strictly from the vulnerability class (broken authorization over composite roles) and the NVD description; no implementation-specific names, endpoints, or parameters beyond those stated are asserted.

1. Reconnaissance and target identification. The attacker identifies a Keycloak deployment with FGAP v2 enabled (the vulnerable subsystem). The attacker already holds a delegated administrative account — for example, an account granted a narrow role-management permission through FGAP v2. Enumeration focuses on identifying existing composite roles in the realm and, specifically, whether any composite role contains a child role with realm-administration privileges under Keycloak's default administrative model.

2. Triggering the flaw. The attacker authenticates with the delegated account and invokes the administrative role-assignment operation against a target user, selecting the identified composite role. Because the FGAP v2 permission check validates the top-level role without inspecting nested children, the assignment is authorized even though the composite transitively contains a far more powerful role. There is no exploitation of memory corruption, injection, or authentication bypass — the vulnerability is purely an authorization-logic gap.

3. Execution method (vulnerability-class level). The "payload" is the assignment of a composite role via the legitimate administrative API/interface. Success depends on the attacker's ability to name or reference a composite role whose hidden children exceed the attacker's own permission level. If no suitable composite role preexists and the attacker's delegated rights permit role creation, the attacker may construct a composite role that bundles a privileged child and then assign it, exploiting the same shallow check.

4. Post-exploitation impact. Once the privileged child role is transitively granted, the attacker's account inherits full administrative control over the realm. From that position the attacker can create or modify users, reset credentials, register malicious clients, alter authentication flows, exfiltrate tokens, or otherwise take over the realm. Because the escalation uses legitimate role assignment, it can blend into normal administrative telemetry.

Note: No public PoC is available; the above chain is derived from the described vulnerability class and should be validated in a controlled lab before operational use.

Impact Assessment

CVE-2026-96448 carries a CVSS v3.1 base score of 6.6. The vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) breaks down as follows: the flaw is exploitable over the network (AV:N), but requires high attack complexity (AC:H) — presupposing the attacker can find or craft a composite role with hidden privileged children — and high privileges (PR:H), meaning the attacker must already hold a delegated administrative account. No user interaction is required (UI:N). Scope is unchanged (S:U), so the impact is confined to the vulnerable Keycloak component rather than escaping to other security authorities.

Despite the moderate base score, the confidentiality, integrity, and availability impacts are each High. A Keycloak realm is the central identity provider for every application that trusts it; full realm administrative control lets an attacker mint assertions, impersonate arbitrary users, disclose credentials and session tokens, and disable or reconfigure authentication services. The blast radius therefore extends to every relying party integrated with the affected realm — SSO clients, APIs, and federated services — even though the CVSS scope is technically unchanged.

Constraints that temper the score: the attacker must already possess a delegated administrative foothold (PR:H), and exploitation is not a simple unauthenticated action (AC:H). This makes the vulnerability most dangerous in maturing zero-trust deployments where administrative duties are deliberately delegated to many accounts, since each delegated account becomes a potential escalation pivot to realm-wide control.

Business impact includes potential full compromise of the organization's authentication fabric, lateral movement into every application that federates with the realm, and a hard-to-detect escalation because it flows through sanctioned administrative workflows. There is no evidence of exploit-in-the-wild activity, and the CVE is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org.

Detection Guidance

Because exploitation occurs through legitimate administrative role assignment rather than malformed traffic, detection should combine application audit-log monitoring, identity-event correlation, and network-layer heuristics.

Sigma Rule

title: Keycloak FGAP v2 Composite Role Privilege Escalation
id: 6f7a2c14-9d3b-4e88-b1c2-96448000a1f1
status: experimental
description: Detects delegated administrators assigning composite roles, a pattern consistent with CVE-2026-96448 privilege escalation via FGAP v2.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96448
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_event:
    operation: 'ASSIGN_ROLE'
  selection_actor_type:
    actorType: 'ADMIN'
  composite_role_indicator:
    - 'composite'
    - 'realm-management'
  condition: selection_event and selection_actor_type
  filter_trusted_admins:
    actorId|endswith: 'service-account'
level: high
falsepositives:
  - Legitimate delegated administrators performed approved composite role assignments.
tags:
  - attack.privilege_escalation
  - attack.t1078.004
  - cve.2026.96448

YARA Rule

rule CVE_2026_96448_Keycloak_FGAP_Composite_Role_Escalation
{
    meta:
        description = "Detects Keycloak administrative audit/log references indicating FGAP v2 composite role assignment abuse (CVE-2026-96448)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96448"
        cve = "CVE-2026-96448"

    strings:
        $op1 = "ASSIGN_ROLE" ascii wide nocase
        $op2 = "composite" ascii wide nocase
        $op3 = "fine-grained" ascii wide nocase
        $op4 = "realm-management" ascii wide nocase
        $user = "FGAP" ascii wide nocase

    condition:
        (uint16(0) == 0x5B7B or filesize < 5MB) and
        any of ($op1, $op2, $op3, $op4) and $user
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96448 Keycloak FGAP v2 Composite Role Assignment Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/realms/"; content:"/users/"; content:"/role-mappings/"; http.content_type; content:"application/json"; classtype:attempted-admin; sid:9644801; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_96448; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96448;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.action == "LOGIN" and event.outcome == "success" ]
  [ any where event.action in ("ASSIGN_ROLE", "role.assignment") and
          process.name : "keycloak*" and
          user.roles : "realm-management" ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:admin
  (action="ASSIGN_ROLE" OR action="assign_role" OR operation="ASSIGN_ROLE")
  (targetRole="*composite*" OR targetRole="*realm-management*" OR resourceType="COMPOSITE_ROLE")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(targetRole) as target_roles values(targetUser) as target_users
        by actorId actorUsername clientId ipAddress
| where count > 0
| eval risk="CVE-2026-96448 delegated admin assigned privileged composite role"
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-96448,">
  <rule id="964480" level="12">
    <decoded_as>json</decoded_as>
    <field name="operation">ASSIGN_ROLE</field>
    <field name="actorType">ADMIN</field>
    <description>CVE-2026-96448: Possible Keycloak FGAP v2 composite role privilege escalation - delegated admin assigned a role.</description>
    <mitre>
      <id>T1078.004</id>
      <id>T1098</id>
    </mitre>
    <group>privilege_escalation,keycloak,</group>
  </rule>
  <rule id="964481" level="14">
    <if_sid>964480</if_sid>
    <field name="targetRole">realm-management</field>
    <description>CVE-2026-96448: Delegated admin assigned realm-management (privileged composite) role - likely realm takeover.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data has been published in the provided intelligence. The following are risk-reduction measures, not vendor-confirmed fixes.

1. Immediate mitigations:

• Audit and minimize the use of composite roles. Identify every composite role in each realm and inspect its nested children; where a composite transitively bundles a privileged role, split it or remove the privileged child.
• Restrict and review FGAP v2 delegated administrator assignments. Remove delegated role-assignment permissions from accounts that do not strictly require them, and apply least privilege to role-management itself.
• Closely monitor administrative audit events for role assignment by delegated accounts, especially assignments involving composite or privileged roles. Configure alerts using the detection content above.
• Where feasible and operationally safe, disable the FGAP v2 delegated role-assignment capability until the vendor issue is resolved, if that is possible in your version.

2. Patch/upgrade steps:

• No patch is currently available. Monitor the Keycloak project's official releases and security advisories for a fix referencing CVE-2026-96448, and the NVD entry for an updated record.
• When a fixed version is published, upgrade all Keycloak instances (including clusters and replicas) promptly and re-verify composite role definitions after upgrade.

3. Long-term hardening:

• Adopt a policy that privileged permissions are never granted exclusively through nested composite roles; enforce flat, explicit role grants for administrative privileges.
• Implement recursive role-resolution validation so that any delegated assignment is checked against the full transitive set of permissions, and require that delegated administrators cannot assign roles that exceed their own effective privileges.
• Continuously review delegated administration and role topology as part of identity governance; treat every delegated admin account as a potential realm-takeover pivot.

References

• NVD — CVE-2026-96448: https://nvd.nist.gov/vuln/detail/CVE-2026-96448
• CWE-285: Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• Keycloak project security advisories and release notes: https://www.keycloak.org/ (verify advisories for CVE-2026-96448)
• MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts: https://attack.mitre.org/techniques/T1078/004/
• FIRST EPSS: Not yet scored for CVE-2026-96448 (last checked against FIRST.org data; no value available). No CISA KEV entry and no known exploit-in-the-wild evidence at the time of writing.