GHSA-7pm9-g8jh-3m74Medium· 4.9▾ SunlitDuplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-9jrw-8xf7-xqhq. This link is maintained to preserve external references.
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
org.keycloak:keycloak-services < 26.6.4Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9083Medium· 4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-9086High· 7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token
GHSA-q929-g23j-2rc7Medium· 6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token