Medium [CVE-2026-9705] Attacker can re-enable and take over disabled clients via Registration Access Token
This medium-severity Red Hat Linux advisory covers CVE-2026-9705 affecting Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6.4.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled.
This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.
This allows the attacker to bypass the administrator's explicit intent to disable the client, reset its secret, and restore OAuth client_credentials capability, potentially leading to unauthorized access to resources. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Weakness: CWE-613. Affected Red Hat products: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.13; Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.4.
Red Hat fixing advisory: RHSA-2026:30050, RHSA-2026:30049, RHSA-2026:30084, RHSA-2026:30083.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
- rhbk/keycloak-operator-bundle:26.4.13-1
- rhbk/keycloak-rhel9:26.4-19
- rhbk/keycloak-rhel9-operator:26.4-19
- rhbk/keycloak-rhel9
- rhbk/keycloak-operator-bundle:26.6.4-2
- rhbk/keycloak-rhel9:26.6-8
- rhbk/keycloak-rhel9-operator:26.6-8
- RHSA-2026:30050
- RHSA-2026:30049
- RHSA-2026:30084
- RHSA-2026:30083
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict network access to the Keycloak Dynamic Client Registration endpoint. Configure network firewalls to allow connections only from trusted hosts or networks that legitimately require access to this functionality. This limits the exposure of the vulnerable endpoint to unauthorized access attempts.
Official advisory · high-confidence parse· fetched 23 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.