---
id: "CVE-2026-0976"
kind: "vulnerability"
aliases: ["CVE-2026-0976", "GHSA-v897-pv23-r8cw"]
title: "Keycloak has an improper input validation vulnerability"
severity: "low"
cvss: 3.700000047683716
epss: 0.00395999988541007
exploited: false
status: "open"
category: "package"
products: [{"name": "org.keycloak:keycloak-quarkus-server", "fixed": [], "affected": "<= 26.2.5", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-20", "java", "keycloak", "package", "reverse-proxy", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-01-15T13:16:04+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-v897-pv23-r8cw", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0976", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Keycloak has an improper input validation vulnerability

Keycloak accepts RFC matrix parameters in URL path segments that some reverse proxies ignore or mishandle, so path filters can be bypassed. An unauthenticated remote attacker could reach admin or sensitive endpoints that the proxy was meant to block.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.keycloak:keycloak-quarkus-server affected <= 26.2.5 fixed ?

## How to check

Check the Keycloak version in use (affected: maven org.keycloak:keycloak-quarkus-server up to 26.2.5).
Review the reverse proxy rules that block /admin or other paths and test whether a path with a semicolon matrix parameter (e.g. /admin;x=1) gets past them.
Fixed version: unknown

## Fix

Upgrade keycloak-quarkus-server to a version later than 26.2.5 (fixed version not stated in the sources; check GHSA-v897-pv23-r8cw).
Until patched, block or normalize ';' in URL paths at the proxy and restrict admin endpoints at the network level.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-v897-pv23-r8cw
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0976

## From the sources

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_