What’s Vulnerable › Vulnerabilities

CVE-2026-101333: Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-28 · updated 2026-09-28
• Weakness: CWE-770

Description

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the listener is configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, causing the system to create an unlimited number of metric time series. This can lead to excessive memory consumption and degrade the performance of both the server and its monitoring tools.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-101333
• https://bugzilla.redhat.com/show_bug.cgi?id=2542498

Get alerted when CVE-2026-101333 or the next vulnerability affects your stack