CVE-2026-18571 is a medium severity (record score 6.6) flaw in Keycloak when Fine-Grained Admin Permissions V2 is enabled. A sub-administrator who can create users may add them to any group, even groups they cannot manage. Red Hat lists errata RHSA-2026:68277 and RHSA-2026:68278 for the fix.
What's affected
The record lists Red Hat build of Keycloak. The flaw only applies when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled, which is not the default, according to Red Hat's assessment.
The Red Hat CVE page we fetched does not list affected or fixed package versions and links no errata. The NVD record references two errata, RHSA-2026:68277 and RHSA-2026:68278, and Bugzilla entry 2509759. Read those errata for the exact fixed builds for your product stream, since we could not confirm versions.
Severity differs by source. The record and Red Hat show 6.6 (medium, with high attack complexity and high privileges). NVD's own score is 7.2, which is high, with low attack complexity. Both use the same impacts. Red Hat rates the issue Moderate and states that no mitigation is available.
How to check if you're exposed
First check whether you use FGAP V2. In the Keycloak admin console, the Server info page lists the enabled features, and you can also see whether realms use fine-grained admin permissions under their permissions settings. If it is not enabled, the issue does not apply to you.
If it is enabled, list the sub-administrators who hold the permission to create users. Those are the accounts that can abuse the flaw. Then review recently created users and their group memberships, looking for new accounts in groups that the creator should not manage.
Finally, record the installed Keycloak build, and compare it with the builds named in the errata.
What to do now
- Determine whether FGAP V2 is enabled in any realm.
- Read errata RHSA-2026:68277 and RHSA-2026:68278 and apply the one that matches your product stream.
- Until patched, limit which sub-administrators can create users.
- Audit users created by sub-administrators and their group memberships, especially groups tied to sensitive roles.
- Remove any unauthorized memberships and review the roles granted through those groups.
- Re-check after the update to confirm the version.
Why it matters
The weakness class is CWE-862, missing authorization. User creation is allowed, and the endpoint lets the caller choose groups for the new user without checking whether the caller has rights over those groups. A person who may only manage a small part of a realm can therefore reach into other parts by creating an account there.
Because groups often carry roles, adding a user to a powerful group is a way to gain access. Delegated administration is meant to limit blast radius, and this flaw weakens that promise. The prerequisites, a non-default feature plus a trusted sub-administrator, keep the score at medium. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect default Keycloak installs?
Only when Fine-Grained Admin Permissions V2 is enabled, which Red Hat describes as non-default.
Why do the scores differ?
Red Hat and the record say 6.6, NVD says 7.2. They differ in the attack complexity rating.
Sources
Last reviewed: 18 October 2026.
