【高危】keycloak-services：权限控制风险（GHSA-32h4-44jj-c5vx）

安全情报快照 · 风险级别：高危 · CVSS：7.3 · CVE-2026-9795 · GHSA-32h4-44jj-c5vx

先看结论

keycloak-services存在权限控制风险，< 26.6.4 受影响，建议升级至 26.6.4。

影响范围

处置建议

优先将 org.keycloak:keycloak-services 升级至 26.6.4 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Description

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

来源与许可

• GitHub Advisory GHSA-32h4-44jj-c5vx
• https://github.com/keycloak/keycloak/security/advisories/GHSA-32h4-44jj-c5vx
• https://nvd.nist.gov/vuln/detail/CVE-2026-9795
• https://github.com/keycloak/keycloak/issues/50350
• https://github.com/keycloak/keycloak/pull/50451
• https://github.com/keycloak/keycloak/commit/8894c027e788904c740ff9a1a60fcfaa34a10d13
• https://access.redhat.com/errata/RHSA-2026:30049
• https://access.redhat.com/errata/RHSA-2026:30050
• https://access.redhat.com/errata/RHSA-2026:30083
• https://access.redhat.com/errata/RHSA-2026:30084
• https://access.redhat.com/security/cve/CVE-2026-9795
• https://bugzilla.redhat.com/show_bug.cgi?id=2482462
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9795.json

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。