CVE-2026-9083: Keycloak Filesystem Path Traversal Information Disclosure

Technical summary

CVE-2026-9083 is a path traversal information disclosure vulnerability (CWE-22) in Keycloak that permits authenticated realm administrators to submit arbitrary filesystem paths as keystore parameters during key provider component creation. By observing whether the system accepts, rejects, or times out on various paths, an attacker can infer file existence and readability permissions within the Keycloak process's operating context. The vulnerability requires high privilege level (manage-realm role) but operates over the network without user interaction, resulting in a CVSS v3.1 score of 4.9 (MEDIUM severity).

Business impact

An internal threat actor or compromised administrative account can systematically probe your infrastructure's file layout to identify configuration files, private keys, credentials, or other sensitive data without triggering obvious alerts. This reconnaissance significantly reduces the attacker's cost to identify high-value targets for credential theft, configuration exfiltration, or privilege escalation—effectively lowering the bar for lateral movement or data exfiltration attacks that follow.

Affected systems

Red Hat Build of Keycloak installations are affected. Organizations running Keycloak in production for identity management, especially those with multiple realm administrators or federated admin models, should inventory their deployment and verify which versions are in use. Check your Red Hat subscription status and vendor advisory for precise version boundaries.

Exploitability

Exploitation requires existing realm administrator credentials and network access to the Keycloak management API. The attack is deterministic and repeatable—no race conditions or timing dependencies. While the barrier to entry is moderate (admin-level access required), the technique is straightforward and can be automated to scan thousands of paths rapidly. This is not currently listed on the Known Exploited Vulnerabilities catalog.

Remediation

Apply patches from Red Hat as soon as they become available via your standard vendor release channels. Immediately review realm administrator role assignments and restrict the "manage-realm" permission to only those users who absolutely require it. Monitor and log all key provider component creation activities, paying particular attention to unusual or repeated path submissions. Consider network segmentation to limit admin API exposure to trusted networks.

Patch guidance

Check Red Hat's security advisory and Keycloak release notes for the corrected version. Apply patches to all Keycloak instances, including dev and staging environments where admin accounts may have broader access. Test in a non-production environment first, paying attention to any key provider configurations that may be affected by validation changes. Verify that after patching, administrative users can still create legitimate key providers without disruption.

Detection guidance

Monitor Keycloak's management logs for key provider component creation events that reference suspicious or non-standard filesystem paths (look for traversal patterns like "../", absolute paths outside expected directories, or references to /etc, /proc, /sys, or other sensitive mount points). Set up alerts on failed or repeated attempts to create key providers with different path arguments. Correlate with access logs to identify which user accounts are performing these operations and from which source IPs.

Why prioritize this

Although the CVSS score is moderate (4.9), this vulnerability enables attackers to lower the cost of follow-on attacks by conducting low-noise reconnaissance. Organizations with strict change management and strong admin access controls face lower risk, but those with many realm administrators, shared credentials, or weak API endpoint isolation should prioritize remediation to prevent reconnaissance that could lead to credential theft or configuration exfiltration.

Risk score, explained

The CVSS v3.1 score of 4.9 reflects a network-accessible vulnerability requiring high privilege (realm administrator) that results in confidentiality impact (information disclosure about file existence and readability) but no integrity or availability impact. The score is capped at MEDIUM because exploitation demands pre-existing admin credentials; however, the combination of ease of automation and use as a reconnaissance tool for follow-on attacks warrants close attention despite the moderate numeric score.

Frequently asked questions