Information Disclosure Vulnerability in Keycloak by Red Hat
CVE-2026-9083

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Vendor
CVE Published:
25 June 2026

What is CVE-2026-9083?

A significant vulnerability has been identified in Keycloak, affecting realm administrators with the 'manage-realm' role. By exploiting this flaw, an administrator can input arbitrary filesystem paths when setting up key provider components. This could lead to information disclosure, allowing them to ascertain the existence and readability of various files within the Keycloak process environment. Such insights may pave the way for subsequent targeted attacks, emphasizing the need for immediate attention and mitigation strategies.

References

https://access.redhat.com/security/cve/CVE-2026-9083
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2480168
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Swapnil Paliwal & Security Team (AxiomCode) for reporting this issue.
.