Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T15:58:16 keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CWE-22

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

Medium: This flaw in Keycloak allows a highly privileged realm administrator with the "manage-realm" role to perform arbitrary filesystem path probing. By submitting a crafted keystore path, an authenticated attacker can determine the existence and readability of files on the Keycloak server, potentially identifying high-value targets for further attacks. Exploitation requires an attacker to possess the "manage-realm" role, which is a high-level administrative permission. Red Hat would like to thank Swapnil Paliwal & Security Team (AxiomCode) for reporting this issue. Ensure that only highly trusted administrators are granted the "manage-realm" role within Keycloak. This role provides extensive administrative privileges, including the ability to exploit this vulnerability for filesystem probing. Regularly review and audit users assigned to this role to minimize the attack surface. Red Hat build of Keycloak 26.4 2026-06-25T00:00:00Z RHSA-2026:30050 rhbk/keycloak-operator-bundle:26.4.13-1 Red Hat build of Keycloak 26.4 2026-06-25T00:00:00Z RHSA-2026:30050 rhbk/keycloak-rhel9:26.4-19 Red Hat build of Keycloak 26.4 2026-06-25T00:00:00Z RHSA-2026:30050 rhbk/keycloak-rhel9-operator:26.4-19 Red Hat build of Keycloak 26.4.13 2026-06-25T00:00:00Z RHSA-2026:30049 rhbk/keycloak-rhel9 Red Hat build of Keycloak 26.6 2026-06-25T00:00:00Z RHSA-2026:30084 rhbk/keycloak-operator-bundle:26.6.4-2 Red Hat build of Keycloak 26.6 2026-06-25T00:00:00Z RHSA-2026:30084 rhbk/keycloak-rhel9:26.6-8 Red Hat build of Keycloak 26.6 2026-06-25T00:00:00Z RHSA-2026:30084 rhbk/keycloak-rhel9-operator:26.6-8 Red Hat build of Keycloak 26.6.4 2026-06-25T00:00:00Z RHSA-2026:30083 rhbk/keycloak-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-9083 https://nvd.nist.gov/vuln/detail/CVE-2026-9083