Keycloak Client Management Code Injection (CVE-2026-120984)

Keycloak lets an administrator import or create a client with authorization services turned on, which sets up fine-grained permission policies for that client, including optional JavaScript-based policies. Red Hat says the server does not properly clear an internal session attribute left over from that setup step.

A delegated client manager, someone with client management permissions but not full realm admin rights, can supply a malicious JavaScript policy during that same setup window. Red Hat says that script then runs on the server the next time the authorization service evaluates it.

What an Attacker Gains

Per Red Hat's advisory, the script runs inside the Keycloak application server process itself. Red Hat says this breaks the separation between realms, Keycloak's term for separate tenant spaces, and can affect the shared host and any co-hosted realm.

Red Hat notes that in multi-tenant deployments, script-based policies are restricted by default to preserve that separation. The uncleared session attribute is what lets an already-authorized client manager bypass that restriction and import an inline script anyway.

We leave out the exact session attribute and request flow on purpose. Our remote code execution entry explains what an attacker can do once code runs on a server.

How CVE-2026-120984 Scores

Red Hat, the CNA, scores it CVSS 3.1 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The CVE record lists the same score and vector. There is no CVSS 4.0 score in the record or NVD, which lists the entry as Awaiting Analysis.

Red Hat rates the issue Important rather than Critical. Its advisory says that rating reflects the need for an authenticated attacker holding a delegated, elevated administrative role, not an open network path.

What Red Hat Says About a Fix

Red Hat's advisory lists no mitigation that meets its Product Security criteria for ease of use, deployment reach or stability. The advisory names no fixed package version for Keycloak or Red Hat Single Sign-On 7.

We recommend limiting who holds delegated client management rights until Red Hat publishes a fix. Watching Red Hat's advisory page for an update is the only way to know when that happens.

What the Record Says About Exploitation and KEV

The CVE record and Red Hat's advisory do not state whether CVE-2026-120984 has been exploited. It is not in the CISA Known Exploited Vulnerabilities catalog, version 2026.11.06.

Red Hat credits Nassim Abbaoui of OVHcloud and Marcin Naskręt of UNSHADE for reporting the issue. Red Hat's own tracking bug was still in status NEW as of 7 November 2026.

The CVE record lists three Red Hat products as affected. They are Red Hat Build of Keycloak, as the keycloak-services package and the rhbk/keycloak-rhel9 container image, and Red Hat Single Sign-On 7, as the keycloak-services package. The record gives no version ranges and no fixed version for any of them.

Unlike a related Keycloak flaw Red Hat disclosed the same week, CVE-2026-117691, this record marks Red Hat Single Sign-On 7 as affected rather than unaffected. A researcher reported the flaw to Red Hat on 30 October 2026, and Red Hat's bug entry remained in status NEW on 7 November 2026.

We recommend reading Red Hat's CVE page for the current fix status of your build, since the advisory names no release yet. Our vulnerability management guide covers how to track a flaw whose fix is not yet published.