A critical vulnerability in Keycloak, the widely used open-source identity and access management system, could allow an attacker to run malicious code on the server — and no fix is currently available.

The flaw, tracked as CVE-2026-120984, was published on 7 November 2026 and carries a CVSS score of 9.1. It sits in the Keycloak server's client management component. When a client is created or imported with authorisation services enabled, the system fails to clear an internal session attribute properly during the setup process.

An authenticated attacker who holds client-management permissions can exploit that weakness to bypass security controls and upload a malicious JavaScript policy. The policy is then executed on the server when an authorisation request is made, which could allow the attacker to run arbitrary code and potentially compromise the entire system.

Red Hat, which ships the Red Hat Build of Keycloak, has said it currently does not offer a fix or an effective mitigation that meets its criteria for ease of use, deployment, applicability and stability. Because exploitation requires an authenticated user with specific permissions, Red Hat rates the flaw as Important rather than Critical, even though the CVSS score puts it in the critical band.

The vulnerability is not known to be exploited in the wild and has not been added to CISA's Known Exploited Vulnerabilities catalogue. No public exploit code has been confirmed.

Organisations running Keycloak should review who holds client-management permissions and tighten them to the minimum necessary, while watching for a patch from Red Hat or the upstream Keycloak project. Untrusted users should not be given the ability to create or import clients.

[Source: radar.offseq.com](https://radar.offseq.com/threat/cve-2026-120984-improper-control-of-generation-of-code-in-red-hat-red-hat-build-of-keycloak-bd4fa00ddc0e6799) | [Source: thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-120984/)