CVE-2026-9083

MEDIUM

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

Title source: cna
STIX 2.1

Description

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30083
https://access.redhat.com/errata/RHSA-2026:30083
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30084
https://access.redhat.com/errata/RHSA-2026:30084
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-9083
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2480168
https://bugzilla.redhat.com/show_bug.cgi?id=2480168
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30049
https://access.redhat.com/errata/RHSA-2026:30049
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:30050
https://access.redhat.com/errata/RHSA-2026:30050

Scores

CVSS v3 4.9
EPSS 0.0052
EPSS Percentile 40.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (8)
Red Hat/Red Hat Build of Keycloak
Red Hat/Red Hat build of Keycloak 26.4 26.4-19
Red Hat/Red Hat build of Keycloak 26.4 26.4.13-1
Red Hat/Red Hat build of Keycloak 26.4.13
Red Hat/Red Hat build of Keycloak 26.6 26.6-8
Red Hat/Red Hat build of Keycloak 26.6 26.6.4-2
Red Hat/Red Hat build of Keycloak 26.6.4
redhat/build_of_keycloak 26.4 - 26.4.13
Published Jun 25, 2026
Tracked Since Jun 25, 2026