Vulnerability record · CVE-2026-15572 · published 5 August 2026
CVE-2026-15572: Redhat build of keycloak type confusion vulnerability
Redhat · Build Of Keycloak
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
Description
A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:50846 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2026:50847 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2026:50848 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2026:50849 | Vendor Advisory |
| https://access.redhat.com/security/cve/CVE-2026-15572 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2499592 | Issue TrackingVendor Advisory |
Track CVE-2026-15572 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-15572), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
