Live › vulnerability › CVE-2026-0976
Go to dashboardKeycloak accepts RFC matrix parameters in URL path segments that some reverse proxies ignore or mishandle, so path filters can be bypassed. An unauthenticated remote attacker could reach admin or sensitive endpoints that the proxy was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-quarkus-server | maven | <= 26.2.5 | – |
26.2.5)26.2.5 (fixed version not stated in the sources; check GHSA-v897-pv23-r8cw)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
This page as .md · .json · in your agent: get_signal("CVE-2026-0976")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.