Do not allow updates on the realm-management client by pedroigor · Pull Request #49624 · keycloak/keycloak

pedroigor · 2026-06-02T19:51:25Z

keycloak- 8000 github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-06-03T01:52:36Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.LoginTest#loginWithoutForcePasswordChangePolicy

Keycloak CI - Store IT (mariadb)

java.lang.IllegalArgumentException: No enum constant org.keycloak.testsuite.pages.AppPage.RequestType.
	at java.base/java.lang.Enum.valueOf(Enum.java:293)
	at org.keycloak.testsuite.pages.AppPage$RequestType.valueOf(AppPage.java:58)
	at org.keycloak.testsuite.pages.AppPage.getRequestType(AppPage.java:47)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
...

Report flaky test

stianst

Please fix the linked issue; it's certainly not #658 ;)

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-06-03T11:48:47Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.JavascriptException: 
TypeError: can't access property "outerHTML", document.documentElement is null
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-06-03T20:54:14Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Keycloak CI - Forms IT (firefox)

org.openqa.selenium.JavascriptException: 
TypeError: can't access property "outerHTML", document.documentElement is null
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

vramik

Overall LGTM, thanks @pedroigor.

One question about view-system removal: what happens to deployments that had view-system assigned to users? Do we need some kind of migration?

pedroigor · 2026-06-05T10:43:47Z

Based on reviews and my own assumption, deployments should no longer use view-system since 26.5.4:

It was already marked for removal. See https://www.keycloak.org/docs/26.6.3/upgrading/#notable-changes-7
You now have metrics, the cpu, memory (jvm and host) can be fetched as metrics
The server info endpoint was mainly designed for the Admin UI and an internal API until 26.4.2
The server info endpoint (might) expose sensitive data; as such, view-system was too overprivileged, somewhat indicating a high level of trust (manage-realm)

pedroigor · 2026-06-05T10:55:07Z

@vramik, updated the upgrade note with more information.

vramik · 2026-06-05T10:57:20Z

Thanks, my query was not about whether we need to provide a replacement for the role, 100% agree with removing it. I was just wondering whether we rely on the fact that people should not use it as it is deprecated, and therefore we do not need to provide any kind of migration. Or whether we need to, for instance, remove the role from DB.

pedroigor · 2026-06-09T10:58:14Z

@vramik As discussed, there will be no automatic migration:

The role was added as a fallback for a very corner case
Adding migration will make the exception the rule and potentially impact (the majority) deployments not using this role at all
The role has been deprecated for quite some time and people should not be using it

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-06-09T11:56:55Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsLoginAndPassiveCheck

Keycloak CI - Forms IT (chrome)

org.opentest4j.MultipleFailuresError: 
Multiple Failures (2 failures)
	org.openqa.selenium.TimeoutException: timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginActionWithoutExecutionInRequiredActions

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginWithDifferentClients

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#expiredAuthenticationAction_expiredCodeCurrentExecution

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testInjectRedirectUriInClientDataAfterAuthSessionExpiration

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-06-09T12:14:59Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsLoginAndPassiveCheck

Keycloak CI - Forms IT (chrome)

org.opentest4j.MultipleFailuresError: 
Multiple Failures (2 failures)
	org.openqa.selenium.TimeoutException: timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginActionWithoutExecutionInRequiredActions

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginWithDifferentClients

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#expiredAuthenticationAction_expiredCodeCurrentExecution

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testInjectRedirectUriInClientDataAfterAuthSessionExpiration

Keycloak CI - Forms IT (chrome)

org.openqa.selenium.TimeoutException: 
timeout: Timed out receiving message from renderer: 10.000
  (Session info: chrome=148.0.7778.178)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1015-azure', java.version: '25.0.3'
...

Report flaky test

Closes keycloak#49427 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

resolved

From 26.7.0 Keycloak refuses every change to its realm-management client (the fix of CVE-2026-9796, keycloak/keycloak#49624). Management Identity 8.9 changes that client when it creates the realm, so it stops with a 403 and IdentityReady stays Creating. The pages of both Keycloak modes say so, the examples move to 26.6.4, and the Keycloak Operator prerequisite names the release that matches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012QtvcueQcN6WYrufnvgYrD

pedroigor requested review from a team as code owners June 2, 2026 19:51

pedroigor commented Jun 2, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java Resolved

pedroigor mentioned this pull request Jun 2, 2026

fix(admin): block TOCTOU rename bypass of protected admin roles #49516

Closed

3 tasks

pedroigor force-pushed the cve-658 branch from bdb22fa to c34aefd Compare June 2, 2026 20:07

sguilhen approved these changes Jun 2, 2026

View reviewed changes

keycloak-github-bot Bot added the flaky-test label Jun 2, 2026

keycloak-github-bot Bot mentioned this pull request Jun 2, 2026

Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled #48119

Closed

pedroigor force-pushed the cve-658 branch 2 times, most recently from 7e4328f to 362163c Compare June 3, 2026 01:51

keycloak-github-bot Bot reviewed Jun 3, 2026

View reviewed changes

pedroigor commented Jun 3, 2026

View reviewed changes

Comment thread docs/documentation/upgrading/topics/changes/changes-26_6_3.adoc Resolved

pedroigor force-pushed the cve-658 branch from 362163c to 3e85d2c Compare June 3, 2026 02:02

stianst previously requested changes Jun 3, 2026

View reviewed changes

pedroigor force-pushed the cve-658 branch from 3e85d2c to 32e8651 Compare June 3, 2026 10:48

keycloak-github-bot Bot reviewed Jun 3, 2026

View reviewed changes

pedroigor force-pushed the cve-658 branch 3 times, most recently from 6e1e1b2 to ccbe311 Compare June 4, 2026 04:10

stianst self-requested a review June 4, 2026 11:48

vramik reviewed Jun 5, 2026

View reviewed changes

pedroigor force-pushed the cve-658 branch 2 times, most recently from 67e5ed3 to 417891b Compare June 5, 2026 10:53

vramik approved these changes Jun 9, 2026

View reviewed changes

pedroigor force-pushed the cve-658 branch from 417891b to d9397db Compare June 9, 2026 11:03

keycloak-github-bot Bot reviewed Jun 9, 2026

View reviewed changes

pedroigor force-pushed the cve-658 branch from d9397db to 0d9a98a Compare June 9, 2026 17:52

Do not allow updates on the realm-management client

49298e5

Closes keycloak#49427 Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>

pedroigor force-pushed the cve-658 branch from 0d9a98a to 49298e5 Compare June 9, 2026 18:55

ahus1 enabled auto-merge (squash) June 10, 2026 05:50

ahus1 approved these changes Jun 10, 2026

View reviewed changes

ahus1 merged commit 39cb8de into keycloak:main Jun 10, 2026
88 checks passed

github-actions Bot mentioned this pull request Jun 10, 2026

[Vulnerability] keycloak/keycloak: Improper Access Control / Privilege Escalation vitorfhc/videt#156

Open

sschu mentioned this pull request Jul 20, 2026

403 on updating realm-management client #51036

Closed

2 tasks done

jtregl mentioned this pull request Jul 31, 2026

Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 #51323

Closed

2 tasks done

alehhu mentioned this pull request Jul 31, 2026

fix(admin/api): verify role belongs to master realm when checking for protected admin roles #51329

Merged

This was referenced Aug 23, 2026

test(e2e): prove the management plane with the Keycloak Operator in kind konsole-is/camunda-operator#211

Merged

Lift the Keycloak 26.7 ceiling of the management plane when Management Identity 8.9 starts against it konsole-is/camunda-operator#212

Open

Jonomir mentioned this pull request Oct 2, 2026

data "keycloak_openid_client" fails with 403 on internal clients since Keycloak 26.6.4 keycloak/terraform-provider-keycloak#1718

Closed

Navigation Menu

Repository navigation

Do not allow updates on the realm-management client - #49624

Do not allow updates on the realm-management client#49624
ahus1 merged 1 commit into
keycloak:mainfrom
pedroigor:cve-658

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.forms.LoginTest#loginWithoutForcePasswordChangePolicy

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsLoginAndPassiveCheck

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginActionWithoutExecutionInRequiredActions

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginWithDifferentClients

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

org.keycloak.testsuite.forms.MultipleTabsLoginTest#expiredAuthenticationAction_expiredCodeCurrentExecution

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testInjectRedirectUriInClientDataAfterAuthSessionExpiration

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsLoginAndPassiveCheck

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginActionWithoutExecutionInRequiredActions

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

org.keycloak.testsuite.forms.MultipleTabsLoginTest#loginWithDifferentClients

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest

org.keycloak.testsuite.forms.MultipleTabsLoginTest#expiredAuthenticationAction_expiredCodeCurrentExecution

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testInjectRedirectUriInClientDataAfterAuthSessionExpiration

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants