CVE-2026-9083
Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
- State
- Published
- Severity
- 4.9 Medium
- Published
- Jun 25, 2026
- Updated
- Jun 26, 2026
- Reserved
- May 20, 2026
Description
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4Red Hat |
|
Red Hat build of Keycloak 26.4.13Red Hat | |
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6Red Hat |
|
Red Hat build of Keycloak 26.6.4Red Hat |
References
- RHSA-2026:30049vendor-advisory
- RHSA-2026:30050vendor-advisory
- RHSA-2026:30083vendor-advisory
- RHSA-2026:30084vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-9083vdb-entry
- RHBZ#2480168issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.