Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw allows a realm administrator to probe the server's internal file system by submitting custom file paths during the configuration of security keys. While this requires administrative privileges, it could allow an attacker to map out sensitive files on the server to prepare for more significant attacks.
Technical details
A path traversal vulnerability (CWE-22) exists in Keycloak's key provider component. A realm administrator with 'manage-realm' privileges can provide an arbitrary filesystem path as a keystore parameter. By observing the application's response, the attacker can determine the existence and readability of files on the underlying host operating system. This information disclosure is limited to files readable by the Keycloak process user but can be used to facilitate further exploitation or reconnaissance of the hosting environment. The attack is reachable over the network but requires high-level administrative credentials.
Affected products
- Red Hat Keycloak unspecified
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-05-20: other: Bug reported to Red Hat Bugzilla
- 2026-06-25: disclosed: CVE published to NVD