Live › vulnerability › CVE-2026-9083
A realm administrator with the manage-realm role can set an arbitrary filesystem path as the keystore parameter when creating a key provider component. The server reveals which files exist and are readable by the Keycloak process, which helps an attacker pick targets for later attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC, 0h before NVD. All times on this page are UTC.
Only Keycloak servers running a version below 26.6.4 are exposed, and only to users who already hold the manage-realm role in a realm. The risk is file existence and readability on the host, not file contents. Teams that restrict realm administration to trusted staff have lower exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | 26.6.4 |
| redhat build of keycloak | vendor | >= 26.4, < 26.4.13 | 26.4.13 |
| redhat build of keycloak | vendor | >= 26.6, < 26.6.4 | 26.6.4 |
kc.sh --version or the Maven artifact org.keycloak:keycloak-services in your build.org.keycloak:keycloak-services to 26.6.4 or later (affected below 26.6.4).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-9083")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.