CVE-2026-12388 Privilege escalation in Red Hat Build of Keycloak

Medium 6.5 Published 30 Jun 2026 Updated 30 Jun 2026

Restricted administrators can escalate privileges to realm administrator by exploiting improper authorization in the identity provider mapper.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-12388?

CVE-2026-12388 is a medium-severity vulnerability in Redhat Build of Keycloak, published on 30 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.

Weakness: CWE-266

Which versions are affected by CVE-2026-12388?

It affects 1 product.

Products include Redhat Build of Keycloak.

How do I fix CVE-2026-12388?

No fix has been published for CVE-2026-12388 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-12388 being exploited?

There is no known exploitation of CVE-2026-12388 in the wild and no public exploit code.

All Redhat Build of Keycloak vulnerabilities

Sources

Also known as GHSA-jxqv-2jjx-692h.