---
id: "CVE-2026-110932"
kind: "vulnerability"
aliases: ["CVE-2026-110932"]
title: "Keycloak: unvalidated theme names let unauthenticated requests exhaust disk space"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "keycloak", "fixed": ["26.8.2"], "affected": "<= 26.8.0 (lower bound not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["identity", "keycloak", "package", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-05T17:17:37+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:44:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110932", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://github.com/keycloak/keycloak/issues/54689", "first_seen_at": "2026-11-05T17:44:50+00:00", "cites": ["https://github.com/keycloak/keycloak/issues/54689", "https://github.com/keycloak/keycloak/releases/tag/26.8.2"]}]
exploit_sources: []
---

# Keycloak: unvalidated theme names let unauthenticated requests exhaust disk space

Keycloak's theme resource endpoint uses requested theme names as keys for an on-disk gzip cache without validating them. An unauthenticated attacker can send many requests with fabricated theme names to fill the disk, and the damage persists across restarts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:keycloak affected <= 26.8.0 (lower bound not stated) fixed 26.8.2

## How to check

Run bin/kc.sh --version (or check the container image tag). Versions up to 26.8.0 are named in the Keycloak issue title; 26.8.1 is not mentioned either way, so move to 26.8.2. Check whether data/tmp/kc-gzip-cache is large or growing. Check whether /resources/... theme paths are reachable from untrusted networks.

## Fix

Upgrade to Keycloak 26.8.2 (release notes list this CVE). The issue is also labelled for release 26.6.8 on the 26.6 line; that release page was not read, so confirm before relying on it.

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110932
- 2026-11-05T17:44:50+00:00 analyst https://github.com/keycloak/keycloak/issues/54689 — Keycloak issue #54689 (title: <= 26.8.0) and 26.8.2 release notes list the CVE. 26.6.8 comes only from an issue label. The advisory text has no workaround; I did not look for a proxy-level mitigation. The lower bound of affected versions is unknown.

## Documents

- [advisory] [CVE-2026-110932] Keycloak <= 26.8.0: Unauthenticated persistent disk exhaustion (theme gzip cache) https://github.com/keycloak/keycloak/issues/54689
- [fix] Keycloak 26.8.2 release notes https://github.com/keycloak/keycloak/releases/tag/26.8.2

## From the sources

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_