AIKIDO-2026-172548
keycloak-services is vulnerable to Path Traversal
49
Medium Risk
This Affects:
keycloak-servicesTL;DR
When creating a key provider component, Keycloak accepts an arbitrary filesystem path as the keystore parameter without restricting it. A realm administrator can supply different paths and observe the resulting behavior to learn which files exist and are readable by the Keycloak process. This discloses information about the host filesystem that can guide follow-on attacks. The fix restricts the keystore path so arbitrary locations can no longer be probed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and untrusted users hold realm administration privileges.
Background info
keycloak-services is vulnerable to Path Traversal in versions 1.0.1.Final - 26.6.3.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:30049access.redhat.com/errata/RHSA-2026:30050access.redhat.com/errata/RHSA-2026:30083access.redhat.com/errata/RHSA-2026:30084access.redhat.com/security/cve/CVE-2026-9083bugzilla.redhat.com/show_bug.cgi?id=2480168
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant