CVE-2026-114232

Fixes and workarounds

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce ownership validation on the resourceType field within UserManagedPermissionService to prevent UMA policies from attaching to resources owned by other users: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validates the resourceType field during policy creation in UserManagedPermissionService to prevent policies from matching resources across different owners during evaluation in DefaultPolicyEvaluator, closing crafted UMA policy creation specifying an arbitrary victim resourceType. Until patched, this is a concern on Keycloak deployments exposing the UMA Protection API where authenticated realm users have permission to create and manage resources, so Restrict authenticated users from creating and managing resources, limit exposure of sensitive resourceType identifiers, and monitor policy definitions created via the UMA Protection API. As a compensating measure, Capture audit records when authenticated users create or modify authorization policies via the UMA Protection API to detect unauthorized cross-owner policy creation. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1006 Privilege Change Audit Logging (medium)