---
id: "CVE-2026-9083"
kind: "vulnerability"
aliases: ["CVE-2026-9083", "GHSA-9jrw-8xf7-xqhq"]
title: "Keycloak vulnerable to information disclosure through arbitrary filesystem path probing"
severity: "medium"
cvss: 4.9
epss: 0.0078
exploited: false
status: "open"
category: "package"
products: [{"name": "org.keycloak:keycloak-services", "fixed": ["26.6.4"], "affected": "< 26.6.4", "ecosystem": "maven"}, {"name": "redhat build of keycloak", "fixed": ["26.4.13"], "affected": ">= 26.4, < 26.4.13", "ecosystem": "vendor"}, {"name": "redhat build of keycloak", "fixed": ["26.6.4"], "affected": ">= 26.6, < 26.6.4", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-22", "java", "keycloak", "package", "self-hosted"]
not_affected_if: ["no-untrusted-realm-admins", "version-26.6.4-or-later"]
published_at: "2026-06-25T17:17:03+00:00"
first_seen_at: "2026-10-29T16:39:02+00:00"
updated_at: "2026-10-29T16:56:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9jrw-8xf7-xqhq", "first_seen_at": "2026-10-29T16:39:02+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9083", "first_seen_at": "2026-10-29T16:56:32+00:00"}]
---

# Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

A realm administrator with the manage-realm role can set an arbitrary filesystem path as the keystore parameter when creating a key provider component. The server reveals which files exist and are readable by the Keycloak process, which helps an attacker pick targets for later attacks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.keycloak:keycloak-services affected < 26.6.4 fixed 26.6.4
- vendor:redhat build of keycloak affected >= 26.4, < 26.4.13 fixed 26.4.13
- vendor:redhat build of keycloak affected >= 26.6, < 26.6.4 fixed 26.6.4

## How to check

- Check the Keycloak version with `kc.sh --version` or the Maven artifact `org.keycloak:keycloak-services` in your build.
- Review which accounts hold the manage-realm role in each realm.

## Fix

- Keycloak `org.keycloak:keycloak-services` to `26.6.4` or later (affected below `26.6.4`).

## Timeline

- 2026-10-29T16:39:02+00:00 ghsa https://github.com/advisories/GHSA-9jrw-8xf7-xqhq
- 2026-10-29T16:56:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9083

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-9jrw-8xf7-xqhq
- [advisory] Maintainer's advisory: github.com https://github.com/keycloak/keycloak/security/advisories/GHSA-9jrw-8xf7-xqhq
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30049
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30050
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30083
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/errata/RHSA-2026:30084
- [advisory] Third-party advisory: access.redhat.com https://access.redhat.com/security/cve/CVE-2026-9083
- [advisory] Third-party advisory: bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2480168

## From the sources

### Description
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_