CVE-2026-17526 Privilege escalation in Red Hat Data Grid 8
A user with impersonation role can impersonate realm administrators, gaining full administrative control over the Keycloak realm.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-17526?
CVE-2026-17526 is a high-severity vulnerability in Red Hat Data Grid 8, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users, clients, and roles.
Weakness: CWE-862
Which versions are affected by CVE-2026-17526?
How do I fix CVE-2026-17526?
No fix has been published for CVE-2026-17526 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-17526 being exploited?
There is no known exploitation of CVE-2026-17526 in the wild and no public exploit code.
Sources
Also known as GHSA-j7cq-x5cp-qpcx.