{"id":"CVE-2026-9083","kind":"vulnerability","aliases":["CVE-2026-9083","GHSA-9jrw-8xf7-xqhq"],"related":[],"title":"Keycloak vulnerable to information disclosure through arbitrary filesystem path probing","description":"### Description\nA flaw was found in Keycloak. A realm administrator with the \"manage-realm\" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.","summary":"A realm administrator with the manage-realm role can set an arbitrary filesystem path as the keystore parameter when creating a key provider component. The server reveals which files exist and are readable by the Keycloak process, which helps an attacker pick targets for later attacks.","severity":"medium","cvss":4.9,"epss":0.0078,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":["26.6.4"],"affected":"< 26.6.4","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":["26.4.13"],"affected":">= 26.4, < 26.4.13","ecosystem":"vendor"},{"name":"redhat build of keycloak","fixed":["26.6.4"],"affected":">= 26.6, < 26.6.4","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-22","java","keycloak","package","self-hosted"],"not_affected_if":["no-untrusted-realm-admins","version-26.6.4-or-later"],"how_to_check":"- Check the Keycloak version with `kc.sh --version` or the Maven artifact `org.keycloak:keycloak-services` in your build.\n- Review which accounts hold the manage-realm role in each realm.","fix":"- Keycloak `org.keycloak:keycloak-services` to `26.6.4` or later (affected below `26.6.4`).","status":"open","published_at":"2026-06-25T17:17:03+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:46+00:00","updated_at":"2026-10-29T16:56:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:39:46Z","model":"claude-haiku-5-5","output":{"fix":"- Keycloak `org.keycloak:keycloak-services` to `26.6.4` or later (affected below `26.6.4`).","reach":"network","title":"Keycloak: realm admins can probe server filesystem paths via keystore setting","impact":"low","summary":"A realm administrator with the manage-realm role can set an arbitrary filesystem path as the keystore parameter when creating a key provider component. The server reveals which files exist and are readable by the Keycloak process, which helps an attacker pick targets for later attacks.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","java"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker learns which server files exist and are readable","analyst_note":"","how_to_check":"- Check the Keycloak version with `kc.sh --version` or the Maven artifact `org.keycloak:keycloak-services` in your build.\n- Review which accounts hold the manage-realm role in each realm.","plain_action":"","needs_analyst":false,"not_affected_if":["version-26.6.4-or-later","no-untrusted-realm-admins"],"who_is_affected":"Only Keycloak servers running a version below 26.6.4 are exposed, and only to users who already hold the manage-realm role in a realm. The risk is file existence and readability on the host, not file contents. Teams that restrict realm administration to trusted staff have lower exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4266,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-22':35B '-9083':13A,21A '8xf7':17A '9jrw':16A 'administr':44B,98C,128C 'allow':126C 'arbitrari':7A,54B,112C,131C 'attack':83B,88B,161C 'build':27A,31A 'compon':66B,124C 'could':148C 'creat':62B,120C 'cve':11A,19A 'cwe':34B 'descript':89C 'determin':134C 'disclosur':5A,147C 'exist':72B,137C 'exploit':106C 'file':71B,136C 'filesystem':8A,55B,113C,132C 'flaw':91C 'follow':159C 'follow-on':158C 'found':93C 'ghsa':15A 'ghsa-9jrw-8xf7-xqhq':14A 'help':81B 'high':154C 'high-valu':153C 'host':41B 'identifi':152C 'inform':4A,146C 'java':36B 'key':64B,122C 'keycloak':1A,24A,29A,33A,37B,78B,95C,143C 'keycloak-services':23A 'keystor':59B,117C 'later':87B 'manag':48B,102C 'manage-realm':47B,101C 'of':28A,32A 'org.keycloak':22A 'packag':38B 'paramet':60B,118C 'path':9A,56B,114C,133C 'pick':84B 'probe':10A,130C 'process':79B,144C 'provid':65B,123C 'readabl':75B,140C 'realm':43B,49B,97C,103C 'redhat':26A,30A 'reveal':69B 'role':50B,104C 'self':40B 'self-host':39B 'server':68B 'services':25A 'set':52B 'submit':110C 'target':85B,156C 'use':150C 'valu':155C 'vulner':2A,108C 'xqhq':18A","nicknames":[],"mitigations":[],"who_affected":"Only Keycloak servers running a version below 26.6.4 are exposed, and only to users who already hold the manage-realm role in a realm. The risk is file existence and readability on the host, not file contents. Teams that restrict realm administration to trusted staff have lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-06-25T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9jrw-8xf7-xqhq","url":"https://github.com/advisories/GHSA-9jrw-8xf7-xqhq","severity":"medium","published_at":"2026-10-29T16:38:31+00:00","modified_at":"2026-10-29T16:38:34+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:39:02+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9083","severity":null,"published_at":"2026-06-25T17:17:03+00:00","modified_at":"2026-07-01T17:22:17+00:00","first_seen_at":"2026-10-29T16:56:32+00:00","fetched_at":"2026-10-29T16:56:32+00:00","note":null}],"documents":[{"id":17807,"url":"https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-9jrw-8xf7-xqhq","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17808,"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-9jrw-8xf7-xqhq","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":18033,"url":"https://access.redhat.com/errata/RHSA-2026:30049","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18034,"url":"https://access.redhat.com/errata/RHSA-2026:30050","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18035,"url":"https://access.redhat.com/errata/RHSA-2026:30083","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18036,"url":"https://access.redhat.com/errata/RHSA-2026:30084","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18070,"url":"https://access.redhat.com/security/cve/CVE-2026-9083","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: access.redhat.com"},{"id":18071,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480168","title":"Third-party advisory: bugzilla.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: bugzilla.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}