---
id: CVE-2026-12388
title: >-
  Keycloak-broker: keycloak: privilege escalation to realm administrator via
  improper authorization in identity provider mapper
summary: >-
  A flaw was found in the Identity Provider (IdP) mapper component of Keycloak,
  which is used to manage how user information from external services is mapped
  to Keycloak users. An administrator with limited permissions to manage
  identity p…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-266
vendor: Red Hat
product: rhbk/keycloak-rhel9
affected:
  - rhbk/keycloak-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-30T14:18:51.123959Z'
published: '2026-06-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:25:03.238Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12388'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95761'
    label: 'RHSA-2026:95761'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12388'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2489140'
    label: RHBZ#2489140
tags:
  - cve.org
epss: 0.00405
epssPercentile: 0.34989
ingestedAt: '2026-11-06T10:49:35.388Z'
---

## Overview

A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm.

## Affected

- `rhbk/keycloak-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.