CVE-2026-9083: Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9083?
The severity of CVE-2026-9083 is categorized as medium with a score of 4.9.
What does CVE-2026-9083 allow an attacker to do?
CVE-2026-9083 allows a realm administrator to exploit the vulnerability by probing arbitrary filesystem paths.
How do I fix CVE-2026-9083?
To fix CVE-2026-9083, ensure that only trusted realm administrators have the 'manage-realm' role and restrict their ability to submit arbitrary filesystem paths.
What software is affected by CVE-2026-9083?
The software affected by CVE-2026-9083 is Keycloak.
When was CVE-2026-9083 published?
CVE-2026-9083 was published on June 25, 2026.