CVE-2026-4636: UMA Bypass in Keycloak Services

The core impact of CVE-2026-4636 lies in the ability to circumvent UMA policies. An attacker, already authenticated and possessing the uma_protection role, can craft malicious requests that include resource identifiers belonging to other users. This manipulation allows the attacker to obtain a Requesting Party Token (RPT) for resources they should not have access to. The attacker can then leverage this RPT to access sensitive information or perform unauthorized actions on behalf of the victim user. This effectively grants the attacker privilege escalation within the Keycloak environment, potentially compromising the entire system if the victim user has elevated permissions. The blast radius extends to any resource protected by UMA policies, and any user whose resources are targeted by the attacker.

1. Reserved2026-03-23
2. Published2026-04-02
3. Modified2026-04-04
4. EPSS updated2026-04-10

The primary mitigation for CVE-2026-4636 is to upgrade Keycloak Services to version 26.5.7 or later. If immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with the uma_protection role. Review existing UMA policies to ensure they are properly configured and do not inadvertently grant excessive permissions. Implement a Web Application Firewall (WAF) with rules to detect and block requests attempting to manipulate resource identifiers within UMA policy creation requests. Monitor Keycloak logs for suspicious activity, particularly requests involving resource identifiers from different users. After upgrading, confirm the fix by attempting to create a UMA policy with a resource identifier belonging to a different user and verifying that the request is rejected.