CVE-2026-120984: RCE in Keycloak via JavaScript policy

CVE-2026-120984 identifies a vulnerability in Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy, which is then executed on the server when an authorization request is made.

The vulnerability has CVSS 9.1 (critical per NVD), though declared as high in other sources. It was published on 2026-11-07; no public exploits have been reported on GitHub so far. X signals show 5 posts in the last 24 hours confirming CVE-2026-120984 with arbitrary code execution on the server. No patch is available at publication time, as confirmed by public signals.

Keycloak administrators must immediately verify which instances have authorization services enabled. Restrict client management access permissions to trusted operators only, audit authorization request logs for suspicious activity, and temporarily disable inline JavaScript policies until a patch is released. Monitor public Red Hat advisories for security updates and corrections.