What is CVE-2026-17059?

CVE-2026-17059 is a medium-severity vulnerability in Red Hat Build Of Keycloak, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-07-24.

How severe is CVE-2026-17059?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Red Hat Build Of Keycloak

CVE-2026-17059

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has p…

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2026-17059?: CVE-2026-17059 is a medium-severity vulnerability in Red Hat Build Of Keycloak, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-07-24.
How severe is CVE-2026-17059?: Medium severity. CVSS v3 base score is 6.5 out of 10.