REDHAT-BUG-2501720: Medium severity Keycloak Keycloak vulnerability

Published Jul 17, 2026

Updated

A vulnerability was found in Keycloak where the LDAP storage provider fails to validate the search base during specific entry-DN queries. A delegated administrator with user-query permissions can invoke the admin users endpoint with a crafted query parameter (q=LDAPENTRYDN:target-dn). The LDAP provider replaces the configured users DN with the caller-supplied DN and performs an object-scope lookup. If the target object matches the user schema, Keycloak returns the UserRepresentation and may import the user into local storage. This allows an attacker to bypass organizational unit boundaries within the same LDAP directory to disclose user attributes and metadata for accounts they should not be able to access.

Affected Software

1 affected component

Keycloak Keycloak

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Restrict access to Keycloak's admin users endpoint so that only trusted administrators (no delegated admins with user-query permissions) can invoke it, to prevent crafted query parameters (e.g., q=LDAP_ENTRY_DN:target-dn) from triggering LDAP search base validation bypass.

Event History

Jul 17, 2026

Data Sourced

via Red Hat·01:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can realistically exploit this issue?

Delegated administrators who have permission to query users through Keycloak's admin users endpoint are exposed if Keycloak is using the LDAP storage provider. The issue can disclose accounts outside the organizational unit boundaries configured for that administrator, as long as the accounts are in the same LDAP directory.

What does an attacker need to exploit it?

An attacker needs delegated administrator user-query permissions and must send a crafted query using the LDAP_ENTRY_DN form, such as q=LDAP_ENTRY_DN:target-dn. The target LDAP object must match the user schema for Keycloak to return a UserRepresentation and potentially import the user into local storage.

What can be done if patching is not immediately possible?

The provided information does not identify a patch, workaround, or configuration change. Until a fix is available, restricting delegated administrator access to user-query functionality reduces the ability to invoke the affected endpoint.

REDHAT-BUG-2501720: Medium severity Keycloak Keycloak vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can realistically exploit this issue?

What does an attacker need to exploit it?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically exploit this issue?

What does an attacker need to exploit it?

What can be done if patching is not immediately possible?