---
id: CVE-2026-19608
title: >-
  Keycloak-services: keycloak-services: name-only group claims let same-name
  groups satisfy path-specific group policies
summary: >-
  A flaw was found in the group policy provider of Keycloak authorization
  services, which is used to manage fine-grained access control to resources.
  The issue occurs when the system evaluates group-based policies using tokens
  that only co…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-285
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services
  - rhbk-openshift-rhel9/rhbk-openshift-rhel9
  - keycloak-services
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-18T12:51:22.750972Z'
published: '2026-08-18'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:25:23.251Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19608'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95761'
    label: 'RHSA-2026:95761'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-19608'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2514530'
    label: RHBZ#2514530
tags:
  - cve.org
epss: 0.00272
epssPercentile: 0.19662
ingestedAt: '2026-11-06T10:49:35.385Z'
---

## Overview

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

## Affected

- `keycloak-services`
- `rhbk-openshift-rhel9/rhbk-openshift-rhel9`
- `keycloak-services`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.