Live › vulnerability › GHSA-7pm9-g8jh-3m74
A realm administrator with the manage-realm role can submit an arbitrary filesystem path as a keystore parameter when creating a key provider component. The response reveals which files exist and are readable by the Keycloak process, which can help an attacker pick follow-on targets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Only Keycloak deployments where someone holds the manage-realm role in a realm, since that role is required to create key provider components. The advisory was withdrawn as a duplicate of GHSA-9jrw-8xf7-xqhq, so the canonical record is the one to follow for scope and fix details.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | – |
kc.sh --version or the admin console footer and compare against 26.6.426.6.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-9jrw-8xf7-xqhq. This link is maintained to preserve external references.
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
This page as .md · .json · in your agent: get_signal("GHSA-7pm9-g8jh-3m74")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.