KEYCLOAK · CVE-2026-110932 · Package
FIX → 26.8.2 ✓ verified
Keycloak's theme resource endpoint uses requested theme names as keys for an on-disk gzip cache without validating them. An unauthenticated attacker can send many requests with fabricated theme names to fill the disk, and the damage persists across restarts.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Keycloak servers up to 26.8.0 are exposed if the theme resource endpoint (/resources/<version>/<type>/<theme>/...) is reachable by untrusted clients, because no login is needed. The damage is disk exhaustion that persists across restarts. Teams using a managed identity provider instead of running Keycloak can skip it.
Not affected if auth-required
Who cares identity, keycloak, self-hosted
26.8.0 are named in the Keycloak issue title; 26.8.1 is not mentioned either way, so move to 26.8.2A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.8.2
26.8.2 (release notes list this CVE)26.6.8 on the 26.6 line; that release page was not read, so confirm before relying on it