CVE-2026-19729: Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs realm administrator privileges. The attack is remote over the network and does not require user interaction.
What information can be exposed?
A realm administrator can use keystore parameters with arbitrary filesystem paths to determine whether files exist on the server and whether they are readable. This may reveal sensitive system information, but the provided data does not indicate file-content disclosure or modification.
How can I determine whether my environment is exposed?
Review whether users or service accounts have realm administrator privileges and can configure key provider keystore parameters. Systems running Red Hat Keycloak Services are the affected software identified in the provided data.