CVE-2026-16071: Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.
Other sources
A vulnerability was found in Keycloak where the LDAP storage provider fails to validate the search base during specific entry-DN queries. A delegated administrator with user-query permissions can invoke the admin users endpoint with a crafted query parameter (q=LDAPENTRYDN:target-dn). The LDAP provider replaces the configured users DN with the caller-supplied DN and performs an object-scope lookup. If the target object matches the user schema, Keycloak returns the UserRepresentation and may import the user into local storage. This allows an attacker to bypass organizational unit boundaries within the same LDAP directory to disclose user attributes and metadata for accounts they should not be able to access.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Keycloak (LDAP storage provider)to a version that resolves this vulnerability.Patch Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary - Compensating control
Restrict delegated administrator access to the Keycloak admin endpoint that supports the crafted user-query parameter q=LDAP_ENTRY_DN:target-dn (e.g., remove/limit user-query permissions or block access to the relevant admin users endpoint) to prevent search-base/user-DN boundary bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16071?
The severity of CVE-2026-16071 is medium with a score of 5.4.
What is the risk associated with CVE-2026-16071?
The risk associated with CVE-2026-16071 is rated at 34.
How can I fix CVE-2026-16071?
To mitigate CVE-2026-16071, it is recommended to apply the latest security patch for Keycloak services.
What type of attack does CVE-2026-16071 allow?
CVE-2026-16071 allows a delegated administrator to bypass the configured user DN boundary during LDAP entry-DN user searches.
Which component of Keycloak is affected by CVE-2026-16071?
CVE-2026-16071 affects the LDAP storage provider component of Keycloak.