# CVE-2026-114232: Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access

Status: published. Published: 2026-11-05. Updated: 2026-11-06.

A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.

## Remediation

- workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce ownership validation on the resourceType field within UserManagedPermissionService to prevent UMA policies from attaching to resources owned by other users: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validates the resourceType field during policy creation in UserManagedPermissionService to prevent policies from matching resources across different owners during evaluation in DefaultPolicyEvaluator, closing crafted UMA policy creation specifying an arbitrary victim resourceType. Until patched, this is a concern on Keycloak deployments exposing the UMA Protection API where authenticated realm users have permission to create and manage resources, so Restrict authenticated users from creating and managing resources, limit exposure of sensitive resourceType identifiers, and monitor policy definitions created via the UMA Protection API. As a compensating measure, Capture audit records when authenticated users create or modify authorization policies via the UMA Protection API to detect unauthorized cross-owner policy creation. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing authorization defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1006 Privilege Change Audit Logging (medium) (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-operator-bundle): ≥ 26.4.17-2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-rhel9): ≥ 26.4-29; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.4 (rhbk/keycloak-rhel9-operator): ≥ 26.4-30; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.4.17 (rhbk/keycloak-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-operator-bundle): ≥ 26.6.8-2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-rhel9): ≥ 26.6-24; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.6 (rhbk/keycloak-rhel9-operator): ≥ 26.6-24; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.6.8 (keycloak-services): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat build of Keycloak 26.6.8 (rhbk/keycloak-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Single Sign-On 7 (keycloak-services): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: CNA: redhat

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.32% as of 2026-11-06; percentile 24.50%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:95759 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:95760 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:95761 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:95762 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-114232 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2558074 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:95760 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:95761 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-114232 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2558074 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-114232; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-114232; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-114232; retrieved 2026-11-06; source updated Not reported

Revision: bb303be5c81ce83d8965b4be42af0dd378f2ac06439775bcd8b5d1be53b03431

Canonical: https://y2.dev/cve/CVE-2026-114232

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.