CVE-2026-74909: Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
An incomplete fix for CVE-2026-15573 in Keycloak PathMatcher allows an authenticated attacker to bypass authorization policies. The original fix introduced URI normalization to strip matrix parameters and resolve dot segments, but this cleanup occurs before percent-decoding. Consequently, percent-encoded semicolons (percent-3B) and percent-encoded dot segments (percent-2Epercent-2E) bypass the normalization logic. When the Keycloak policy enforcer is used with a servlet container that decodes these characters during routing (such as Tomcat or WildFly), the enforcer matches the request against a permissive catch-all resource while the container routes the request to a restricted endpoint. This allows a low-privilege user to access protected resources that should be denied by the configured policy.
Other sources
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Keycloak’s policy enforcer/path-matcher logic so that cleanup (strip matrix parameters and resolve dot segments) is performed after percent-decoding; the described issue occurs because the normalization cleanup happens before percent-decoding, allowing percent-encoded semicolons and dot segments to bypass logic.
Keycloak PathMatcher / policy enforcer URI normalization order (normalization before percent-decoding) = Resolve dot segments and strip matrix parameters after percent-decoding (not before) - Compensating control
For Keycloak policy enforcer deployments, do not allow percent-encoded semicolons (percent-3B) and percent-encoded dot segments (percent-2Epercent-2E) in incoming request URIs/paths; block or reject requests containing these encodings at the fronting component (e.g., reverse proxy/WAF/ingress) to prevent policy-enforcer bypass.
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Applications protected by the Keycloak Policy Enforcer are exposed when they run behind a servlet container that decodes percent-encoded semicolons or dot segments during routing, such as Tomcat or WildFly. Exposure also depends on having policy definitions where a permissive catch-all resource can be matched instead of a restricted endpoint.
What does an attacker need to exploit the issue?
The attacker needs to be authenticated with a low-privilege account. They can send requests containing percent-encoded semicolons or percent-encoded dot segments so that the policy enforcer and servlet container interpret the request path differently.
What is the impact of a successful exploit?
A low-privilege authenticated user can bypass configured authorization policies and access protected resources that the policy should deny. The reported impact includes high confidentiality and integrity impact, with no availability impact.