CVE-2026-97311

Executive Summary

CVE-2026-97311 is an authorization flaw (CWE-862, Missing Authorization) in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoints that retrieve groups associated with a specific role fail to enforce individual group visibility permissions, allowing a delegated administrator holding only basic search privileges to enumerate and view detailed information about all groups assigned to a role. Successful abuse results in low-confidentiality information disclosure (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); no patch, public PoC, or exploit code is currently known.

Technical Analysis

Keycloak's administrative model supports delegated administration: a super-administrator can grant a limited administrator a restricted role that permits only certain operations and only visibility into a designated subset of groups. The intended security model is that such a delegated administrator should only be able to see and act on the specific groups they are authorized to manage.

The flaw resides in the Admin REST API endpoints responsible for returning the groups that are associated with a given role. Per the NVD description, these endpoints "do not properly check for individual group visibility permissions." In other words, the access-control decision applied to the group-listing operation is coarser than the access-control decision that should apply at the granularity of each individual group. The endpoint verifies that the caller has some qualifying administrative privilege (in this case, basic search privileges) but does not then filter or deny the results on a per-group basis according to the caller's visibility scope.

The result is a broken access-control condition classified as CWE-862 (Missing Authorization): an authenticated principal with low privileges receives data it is not entitled to. The vulnerability is network-reachable (AV:N) and requires only a low-privileged, authenticated account (PR:L); no user interaction (UI:N) is needed. The confidentiality impact is rated Low (C:L), consistent with a metadata/visibility disclosure that does not, by itself, directly grant write access or compromise credentials. No integrity (I:N) or availability (A:N) impact is stated.

The CVSS vector describes the flaw as scoped to the vulnerable component (S:U), with attack complexity Low (AC:L) — the vulnerable endpoint behaves deterministically for a caller with the necessary basic privileges. The exact endpoint paths, request parameters, and Keycloak versions affected are not specified in the intelligence provided; the description is sparse as to the precise API route and the token/role claims involved. No affected version range is published by any tracked source, and the vendor has not issued a fix or workaround in the available data. Analysts should treat the version boundary as undetermined and verify exposure directly against the deployed Keycloak version and its delegated-administration configuration.

Because the operation is a read/enumeration of role-to-group relationships, the practical exploitation primitive is unauthorized information disclosure through the Admin REST API rather than remote code execution, authentication bypass, or privilege escalation to full administrator. Nonetheless, the disclosed group-to-role mapping can be a high-value reconnaissance input for follow-on attacks, as it reveals organizational structure, privileged group names, and the roles bound to them.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE. The following attack chain is described at the vulnerability-class level and is inferred from the NVD description; specific endpoint paths and parameters are intentionally not fabricated because they are not present in the source data.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Keycloak deployment by locating the administrative console and Admin REST API (e.g., via the Shodan dorks above or direct probing of a known Keycloak hostname). The attacker must possess, or obtain, a valid low-privileged administrative account — a delegated administrator account provisioned with only basic search privileges. This could be a legitimate but over-scoped service account, a contractor/helpdesk admin account, a compromised credential, or an account created through a separate weakness.

2. Triggering the flaw. Authenticating to the Admin REST API with that low-privileged account, the attacker invokes the API functionality that lists the groups associated with a given role. The intended authorization check would restrict the returned groups to those the delegated administrator is permitted to see and would deny or filter visibility-ineligible groups. Because the endpoint does not enforce individual group visibility permissions (CWE-862), the response includes detailed information about all groups assigned to the queried role regardless of the caller's visibility scope. No elevated role, write capability, or user interaction is required; the confidentiality leak is triggered by the read itself.

3. Payload / execution method. At the vulnerability-class level, this is a direct, authenticated REST request to a read endpoint — no code injection, memory corruption, or malicious payload is involved. The attacker enumerates roles (or obtains role identifiers) and then iterates the group-listing operation to harvest the full set of groups bound to each role. The "attack payload" is simply the legitimate API call made with an account whose visibility should have been constrained.

4. Post-exploitation impact. The attacker obtains a mapping of roles to all associated groups, including group names, identifiers, and any other detailed attributes the endpoint returns. This discloses organizational and access-control structure that was intended to be hidden from the delegated administrator. The data can then be used for targeting (identifying privileged or sensitive groups and the roles that grant access to them), social engineering, and planning of further attacks against the environment. No integrity or availability effects are described; the impact is confined to unauthorized information disclosure.

Impact Assessment

Business impact is centered on broken access control and information disclosure within an identity provider — a sensitive position in any environment, since Keycloak brokers authentication and authorization for many downstream applications. A delegated administrator who should see only a narrow set of groups can instead learn the full role-to-group relationship graph, exposing organizational structure, privileged group names, and access-control design.

The CVSS 3.1 subscores quantify this: network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), Low confidentiality impact (C:L), and no integrity (I:N) or availability (A:N) impact, yielding a base score of 4.3 (Medium). The realistic blast radius is the set of Keycloak deployments that (a) run an affected version and (b) rely on delegated administration with restricted group visibility — the exact configuration this control was meant to protect. In multi-tenant or large-enterprise deployments where delegated admins are common, the disclosure can materially aid lateral movement and privilege-escalation planning, even though this CVE alone does not escalate the attacker's privileges. No EPSS score is available (not yet scored by FIRST.org), and the CVE is not in CISA KEV, so there is currently no evidence of active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Keycloak Admin REST API Role-to-Group Enumeration by Low-Privileged Delegated Admin
id: 8f2c1e6a-4b7d-4a2e-9c3f-keycloak97311
status: experimental
description: Detects access to Keycloak Admin REST API endpoints that return groups associated with a role, a pattern abused by a delegated administrator to bypass group visibility permissions (CVE-2026-97311).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97311
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1078
  - attack.discovery
  - cve.2026.97311
logsource:
  product: keycloak
  service: admin-rest
detection:
  selection_endpoint:
    http_url|contains:
      - '/admin/realms/'
    http_url|re: '.*/roles/.*/groups.*'
  selection_method:
    http_method: 'GET'
  condition: selection_endpoint and selection_method
falsepositives:
  - Legitimate super-administrator or fully-authorized admin consoles performing role/group management
  - Automated identity-governance tooling with broad visibility scope
level: medium

YARA Rule

rule CVE_2026_97311_Keycloak_Role_Group_Enumeration
{
    meta:
        description = "Detects Keycloak Admin REST API requests referencing role-to-group retrieval, associated with CVE-2026-97311 visibility bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97311"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "/admin/realms/" ascii nocase
        $b = "/roles/" ascii nocase
        $c = "/groups" ascii nocase
        $d = "group-by-role" ascii nocase

    condition:
        $a and $b and $c
        or
        ($a and $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97311 Keycloak Admin REST API Role-to-Group Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/admin/realms/"; http.uri; content:"/roles/"; http.uri; content:"/groups"; classtype:attempted-recon; reference:cve,2026-97311; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97311; sid:202697311; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.category == "authentication" and event.outcome == "success"
      and url.path : "/admin/realms/*" ]
  [ network where http.request.method == "GET"
      and url.path regex ".*/admin/realms/.*/roles/.*/groups.*" ]

Splunk SPL Query

index=keycloak sourcetype=keycloak_admin_api
(http.url="*/admin/realms/*/roles/*/groups*" OR uri_path="*/admin/realms/*/roles/*/groups*")
http_method="GET"
| stats count min(_time) as first_seen max(_time) as last_seen values(http.url) as urls by src_ip user
| where count > 5
| sort - count
| table first_seen, last_seen, src_ip, user, count, urls

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-97311,">
  <rule id="2026973" level="8">
    <decoded_as>json</decoded_as>
    <field name="http_method">GET</field>
    <field name="http_url">/admin/realms/</field>
    <field name="http_url">/roles/</field>
    <field name="http_url">/groups</field>
    <description>CVE-2026-97311 - Possible Keycloak Admin REST API role-to-group enumeration by delegated admin</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no advisory, and no workaround are identified in the available intelligence.

1. Immediate mitigations.

• Audit delegated-administration assignments. Identify every account holding limited/basic administrative or search privileges and confirm whether the deployment depends on restricted group visibility. Where the exposure is unacceptable, reduce or remove search privileges that permit the vulnerable role-to-group read until a fix is available.
• Apply least privilege aggressively. Since the flaw is reachable with only low-level privileges (PR:L), minimize the number of principals that can authenticate to the Admin REST API and constrain their roles to the narrowest set required.
• Limit network exposure of the Admin REST API and administrative console. Restrict access by network segmentation, allowlisting, or a reverse proxy so that only trusted management networks can reach administrative endpoints.
• Strengthen monitoring (see Detection Guidance) for role-to-group enumeration patterns originating from accounts that should have narrow visibility.

2. Patch / upgrade steps.

• No patched version is currently available from any tracked source. Monitor the vendor (Keycloak) security advisories and the CVE record for a fixed release.
• When a fix is published, upgrade to the patched version as soon as operationally feasible, prioritizing deployments that use delegated administration with restricted group visibility.
• Because no affected version range is published, inventory the exact deployed Keycloak version and apply the vendor's affected-version guidance once it becomes available.

3. Long-term hardening.

• Enforce a documented delegated-administration model with periodic entitlement reviews of group visibility scopes.
• Adopt defense-in-depth around the IdP: restrict administrative surface area, log and alert on all Admin REST API access, and rotate credentials for any account with administrative privileges.
• Track the CVE record for EPSS scoring and CISA KEV status changes, and re-assess severity should exploit activity or a patch emerge.

References

• NVD — CVE-2026-97311: https://nvd.nist.gov/vuln/detail/CVE-2026-97311
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• Keycloak project security advisories: https://www.keycloak.org/security
• CISA Known Exploited Vulnerabilities catalog (current status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (CVE not yet scored): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97311 in the available intelligence; no public PoC, Nuclei template, or exploit code exists.