Bug 2509756 (CVE-2026-18570)

Summary:	CVE-2026-18570 keycloak-services: keycloak-services: Full-scope-disabled client policy validation bypass via omitted fullScopeAllowed
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows the client to obtain tokens with unauthorized role mappings.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-31 12:27:38 UTC

A Missing Authorization vulnerability was found in the Keycloak full-scope-disabled client-policy executor. When the executor is configured with auto-configure disabled, it fails to properly validate client creation or update requests that omit the fullScopeAllowed field. Because the server defaults to fullScopeAllowed=true for non-consent clients, an attacker with delegated client creation privileges can bypass the intended restriction.
Successful exploitation allows an attacker to create a client that possesses full scope access within the realm, even when a policy is active to prevent it. This results in the issuance of tokens containing role mappings that should have been restricted by the realm policy.