{"id":"CVE-2026-110932","kind":"vulnerability","aliases":["CVE-2026-110932"],"related":[],"title":"Keycloak: unvalidated theme names let unauthenticated requests exhaust disk space","description":"A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.","summary":"Keycloak's theme resource endpoint uses requested theme names as keys for an on-disk gzip cache without validating them. An unauthenticated attacker can send many requests with fabricated theme names to fill the disk, and the damage persists across restarts.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":["26.8.2"],"affected":"<= 26.8.0 (lower bound not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["identity","keycloak","package","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Run bin/kc.sh --version (or check the container image tag). Versions up to 26.8.0 are named in the Keycloak issue title; 26.8.1 is not mentioned either way, so move to 26.8.2. Check whether data/tmp/kc-gzip-cache is large or growing. Check whether /resources/... theme paths are reachable from untrusted networks.","fix":"Upgrade to Keycloak 26.8.2 (release notes list this CVE). The issue is also labelled for release 26.6.8 on the 26.6 line; that release page was not read, so confirm before relying on it.","status":"open","published_at":"2026-11-05T17:17:37+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:25+00:00","updated_at":"2026-11-05T17:44:50+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-05T17:42:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: unvalidated theme names let unauthenticated requests exhaust disk space","impact":"low","summary":"Keycloak's theme resource endpoint uses requested theme names as keys for an on-disk gzip cache without validating them. An unauthenticated attacker can send many requests with fabricated theme names to fill the disk, and the damage persists across restarts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Disk fills up, causing persistent service disruption across restarts","analyst_note":"Find the affected and fixed Keycloak versions and any cache or endpoint mitigation in the Keycloak security advisory referenced by NVD.","how_to_check":"- Check the Keycloak version in use against the affected ranges in the NVD entry (unknown in the sources given)\n- Look for an unusually large or growing gzip cache directory on the Keycloak server's disk\n- Check whether the theme resource endpoint is reachable from untrusted networks","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Servers running Keycloak that expose the theme resource endpoint to requests from untrusted clients are exposed, since no login is needed to send the requests. The sources do not name the affected version ranges or any configuration that limits exposure, so the exact scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4254,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak versions and any cache or endpoint mitigation in the Keycloak security advisory referenced by NVD.","search":"'-110932':13A,16A '-2026':12A,15A 'access':83C 'across':64B 'attack':47B,111C 'cach':41B,108C 'caus':135C 'cve':11A,14A 'damag':62B 'disk':9A,39B,59B,106C,127C 'disrupt':137C 'endpoint':28B,74C 'exhaust':8A,129C 'exploit':113C 'fabric':53B,121C 'fail':92C 'fill':57B 'flaw':67C 'found':69C 'gzip':40B,107C 'host':23B 'ident':18B,81C 'issu':87C 'key':34B,101C 'keycloak':1A,17A,19B,24B,76C 'lead':124C 'let':5A 'manag':84C 'mani':50B,117C 'name':4A,32B,55B,96C,123C 'occur':88C 'on-disk':37B,104C 'open':79C 'open-sourc':78C 'packag':20B 'persist':63B,126C 'request':7A,30B,51B,118C 'resourc':27B,73C 'restart':65B,133C 'self':22B 'self-host':21B 'send':49B,116C 'server':91C,132C 'servic':136C 'solut':85C 'sourc':80C 'space':10A,128C 'surviv':131C 'theme':3A,26B,31B,54B,72C,95C,122C 'unauthent':6A,46B,110C 'uniqu':120C 'unvalid':2A 'use':29B,98C 'valid':43B,94C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Keycloak servers up to 26.8.0 are exposed if the theme resource endpoint (/resources/<version>/<type>/<theme>/...) is reachable by untrusted clients, because no login is needed. The damage is disk exhaustion that persists across restarts. Teams using a managed identity provider instead of running Keycloak can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T17:44:50Z","by":"analyst","doc":"https://github.com/keycloak/keycloak/issues/54689","run_id":1806}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["keycloak"],"ptokens":["keycloak"],"labels":["high","identity","keycloak","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110932","severity":null,"published_at":"2026-11-05T17:17:37+00:00","modified_at":"2026-11-05T17:17:37+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110932:1806","url":"https://github.com/keycloak/keycloak/releases/tag/26.8.2","severity":null,"published_at":"2026-11-05T17:44:50+00:00","modified_at":"2026-11-05T17:44:50+00:00","first_seen_at":"2026-11-05T17:44:50+00:00","fetched_at":"2026-11-05T17:44:50+00:00","note":"Keycloak issue #54689 (title: <= 26.8.0) and 26.8.2 release notes list the CVE. 26.6.8 comes only from an issue label. The advisory text has no workaround; I did not look for a proxy-level mitigation. The lower bound of affected versions is unknown.","cites":["https://github.com/keycloak/keycloak/releases/tag/26.8.2","https://github.com/keycloak/keycloak/issues/54689"]}],"documents":[{"id":78339,"url":"https://github.com/keycloak/keycloak/releases/tag/26.8.2","title":"Keycloak 26.8.2 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":78340,"url":"https://github.com/keycloak/keycloak/issues/54689","title":"[CVE-2026-110932] Keycloak <= 26.8.0: Unauthenticated persistent disk exhaustion (theme gzip cache)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}