CVE-2026-9083: Keycloak path traversal in key provider component

CVE-2026-9083 · Severity: medium · CVSS 4.9 · Published 2026-06-25

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw allows a realm administrator to probe the server's internal file system by submitting custom file paths during the configuration of security keys. While this requires administrative privileges, it could allow an attacker to map out sensitive files on the server to prepare for more significant attacks.

Technologies: org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-9083 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9083 being exploited in the wild.
How severe is CVE-2026-9083?
Medium severity, with a CVSS score of 4.9, published 25 June 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4; Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-9083?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9083 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9083?
Check whether you run org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later
    # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability (CWE-22) exists in Keycloak's key provider component. A realm administrator with 'manage-realm' privileges can provide an arbitrary filesystem path as a keystore parameter. By observing the application's response, the attacker can determine the existence and readability of files on the underlying host operating system. This information disclosure is limited to files readable by the Keycloak process user but can be used to facilitate further exploitation or reconnaissance of the hosting environment. The attack is reachable over the network but requires high-level administrative credentials.

Affected products

  • Red Hat Keycloak unspecified
  • Red Hat Red Hat Build of Keycloak unspecified

Identifiers

  • CVE-2026-9083
  • BIT-KEYCLOAK-2026-9083
  • GHSA-9jrw-8xf7-xqhq

Timeline

  • 2026-05-20: other: Bug reported to Red Hat Bugzilla
  • 2026-06-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.