CVE-2026-9083CWE-22

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

Medium · published June 25, 2026

CVSS v3.1
4.9
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00780 · 55.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-25T16:17Z
EPSS history
Timeline
  • 25 JUN 16:17Z
    Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
    cvelistv5