CVE-2026-103884: Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-01 · updated 2026-10-01
Weakness: CWE-22

Description

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.

Affected products

Red Hat build of Keycloak 26.4: all versions

References

https://access.redhat.com/security/cve/CVE-2026-103884

Get alerted when CVE-2026-103884 or the next vulnerability affects your stack