CVE-2026-17526 is a missing authorization vulnerability in Red Hat build of Keycloak 26.4 that allows a user possessing the impersonation role to escalate privileges by impersonating a realm administrator. This flaw enables the attacker to fully control the realm, including user, client, and role management. Red Hat has issued security advisories (RHSA-2026:68276 and RHSA-2026:68277) releasing fixed container images for Keycloak 26.4.16 and 26.6.7, which include patches for this vulnerability among others. The vulnerability has a CVSS 3.1 base score of 7.2 (high severity) with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An attacker with the impersonation role can fully take over a realm administrator account, gaining complete administrative control over the Keycloak realm. This includes the ability to manage users, clients, and roles, potentially compromising the entire identity and access management environment.

Red Hat has released fixed container images for Red Hat build of Keycloak versions 26.4.16 and 26.6.7 that address this vulnerability. Users should update to these versions as soon as possible. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other mitigation or workaround is indicated in the vendor advisories.