The vulnerability CVE-2026-9795 affects Red Hat build of Keycloak versions before 26.6.4. It stems from a flaw in the Fine-Grained Admin Permissions (FGAPv2) feature, where an administrator with limited client management permissions can exploit the system to assign any realm role to a client's scope mapping, including roles with high privileges. This improper scope mapping enforcement allows the injected role to be included in a user's authentication token upon accessing the modified client, effectively bypassing security controls and enabling privilege escalation within the Keycloak realm. The CVSS v3.1 score is 7.3 (High), reflecting network attack vector, high privileges required, user interaction needed, and impact on confidentiality and integrity but not availability. The Red Hat advisories confirm the vulnerability but do not currently provide a patch or official fix. Users should back up their systems and await updates from Red Hat.

Successful exploitation of this vulnerability allows an attacker with limited administrative permissions to escalate privileges by assigning highly privileged realm roles to client scope mappings. This results in unauthorized privilege escalation within the Keycloak realm, potentially compromising authentication tokens and access controls. The impact affects confidentiality and integrity of the authentication system but does not affect availability. There are no known exploits in the wild at this time.

As of the latest Red Hat advisories, no official patch or fix is available for CVE-2026-9795. Users should back up existing installations, including applications, configuration files, and databases, before applying any future updates. It is recommended to monitor Red Hat's security advisories and apply updates promptly once a fix is released. Until then, restrict administrative permissions carefully and review client scope mappings to minimize risk.