CVE-2026-9083: CVE-2026-9083: Arbitrary Filesystem Path Probing in Keycloak Java Keystore Key Provider

CVE-2026-9083: Arbitrary Filesystem Path Probing in Keycloak Java Keystore Key Provider Vulnerability ID: CVE-2026-9083 CVSS Score: 4.9 Published: 2026-10-29 CVE-2026-9083 is a path traversal and information disclosure vulnerability (CWE-22) affecting Keycloak and the Red Hat build of Keycloak. The vulnerability resides in the Java Keystore key provider component (JavaKeystoreKeyProviderFactory), which fails to restrict the user-supplied keystore file path to a designated directory. An authenticated realm administrator holding the 'manage-realm' role can supply arbitrary absolute or relative filesystem paths when configuring a key provider. Because the application returns distinct error messages depending on whether the target path does not exist, lacks read permissions, or fails keystore parsing, an attacker can use this component as an oracle to probe the underlying host filesystem. TL;DR Authenticated Keycloak realm administrators with the 'manage-realm' role can exploit unvalidated file path handling in the java-keystore key provider to enumerate arbitrary files and directories on the underlying server filesystem via differential error responses. Technical Details Vulnerability Type: CWE-22: Path Traversal / Arbitrary Path Probing Affected Component: JavaKeystoreKeyProviderFactory (java-keystore SPI) Attack Vector: Network (Keycloak Admin REST API / UI) Privileges Required: High ('manage-realm' role) CVSS v3.1 Score: 4.9 Medium (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) EPSS Score: 0.78% (55.84th percentile) Security Impact: Host filesystem enumeration and cross-realm keystore probing CISA KEV Status: Not Listed Affected Systems Keycloak Red Hat build of Keycloak Keycloak: >= 26.6.0, < 26.6.4 (Fixed in: 26.6.4) Keycloak: >= 26.4.0, < 26.4.13 (Fixed in: 26.4.13) Red Hat build of Keycloak: >= 26.6, < 26.6.4-2 (Fixed in: 26.6.4-2) Red Hat build of Keycloak: >= 26.4, < 26.4.13-1 (Fixed in: 26.4.13-1) Code Analysis Commit: 1bc0dd3 Restrict java keystore files to a realm folder (#703) Closes CVE-2026-9083 --- a/services/src/main/java/org/keycloak/keys/JavaKeystoreKeyProviderFactory.java +++ b/services/src/main/java/org/keycloak/keys/JavaKeystoreKeyProviderFactory.java @@ -127,8 +139,17 @@ public void validateConfiguration(KeycloakSession session, RealmModel realm, Com .checkSingle(KEY_ALIAS_PROPERTY, true) .checkSingle(KEY_PASSWORD_PROPERTY, true); + Path keystorePath = Paths.get(model.get(KEYSTORE_KEY)).normalize(); + if (!keystorePath.isAbsolute()) { + keystorePath = this.keystoresPath.resolve(realm.getName()).resolve(keystorePath); + } + if (!keystorePath.startsWith(keystoresPath.resolve(realm.getName()))) { + throw new ComponentValidationException(String.format( + "Keystore file '%s' is not under the realm directory '%s'", keystorePath, keystoresPath.resolve(realm.getName()))); + } + try { - KeyWrapper key = new JavaKeystoreKeyProvider(realm, model, session.vault()).loadKey(realm, model); + KeyWrapper key = new JavaKeystoreKeyProvider(keystoresPath, realm, model, session.vault()).loadKey(keystoresPath, realm, model); validateCertificateChain(key.getCertificateChain()); } catch(GeneralSecurityException e) { Mitigation Strategies Upgrade Keycloak to a patched release that confines keystore paths to per-realm directories. Enforce the Principle of Least Privilege by restricting the 'manage-realm' role to fully trusted administrators. Isolate multi-tenant Keycloak instances or audit realm component creation logs for unexpected 'java-keystore' validation failures. Remediation Steps: Upgrade upstream Keycloak deployments to version 26.6.4 or 26.4.13, or upgrade Red Hat build of Keycloak to 26.6.4-2 or 26.4.13-1. Create realm-specific subdirectories under the base keystores directory (by default ${kc.home.dir}/data/). Relocate existing Java KeyStore (.jks, .p12, .bcfks) files into their respective realm subdirectories. If using a non-default base directory, configure the startup parameter: kc.sh start --spi-keys--java-keystore--keystores-path /path/to/keystores. Update the 'keystore' path attribute in each realm's java-keystore key provider configuration to reference the relocated file. References Red Hat CVE-2026-9083 Security Page Red Hat Bugzilla RHBZ#2480168 Keycloak Fix Commit 1bc0dd3ea7129f53d3031687e7bf36c009cf1bca NVD Detail for CVE-2026-9083 CVE.org Record for CVE-2026-9083 Red Hat Security Advisory RHSA-2026:30049 Red Hat Security Advisory RHSA-2026:30050 Red Hat Security Advisory RHSA-2026:30083 Red Hat Security Advisory RHSA-2026:30084 Read the full report for CVE-2026-9083 on our website for more details including interactive diagrams and full exploit analysis.