CVE-2026-16105 is a vulnerability in the RoleContainerResource component of Red Hat Build of Keycloak where certain name-based endpoints in the admin REST API fail to properly enforce authorization checks when managing composite roles. This flaw allows a delegated administrator with manage-realm permissions to remove critical child roles from built-in admin roles, potentially disrupting administrative functions within a realm. The root cause is an incomplete fix for a previous issue, resulting in inconsistent authorization enforcement on these endpoints. The vulnerability has a CVSS v3.1 score of 4.9 (medium severity) with an attack vector of network, low attack complexity, and requiring high privileges. No known exploits are reported in the wild. Red Hat has not provided a patch or effective mitigation at this time.

Successful exploitation allows an attacker with existing high-level delegated administrative privileges (manage-realm) to remove child roles from built-in admin roles. This leads to a loss of integrity in administrative configurations and can disrupt administrative functions within the affected realm. There is no impact on confidentiality or availability reported. The vulnerability does not allow privilege escalation beyond the existing delegated administrator permissions.

Red Hat currently does not offer a patch or mitigation that meets their criteria for ease of use, applicability, or stability. Since exploitation requires high-level delegated administrative privileges, restricting and monitoring such privileges is advisable. Customers should follow Red Hat advisories and consider upgrading to fixed versions if and when they become available. For now, no direct mitigation or workaround is provided by Red Hat.