CVE-2026-9083: CVE-2026-9083: Arbitrary Filesystem Path Probing in Keycloak Java Keystore Key Provider

#security #cve #cybersecurity

CVE-2026-9083: Arbitrary Filesystem Path Probing in Keycloak Java Keystore Key Provider

Vulnerability ID: CVE-2026-9083
CVSS Score: 4.9
Published: 2026-10-29

CVE-2026-9083 is a path traversal and information disclosure vulnerability (CWE-22) affecting Keycloak and the Red Hat build of Keycloak. The vulnerability resides in the Java Keystore key provider component (JavaKeystoreKeyProviderFactory), which fails to restrict the user-supplied keystore file path to a designated directory. An authenticated realm administrator holding the 'manage-realm' role can supply arbitrary absolute or relative filesystem paths when configuring a key provider. Because the application returns distinct error messages depending on whether the target path does not exist, lacks read permissions, or fails keystore parsing, an attacker can use this component as an oracle to probe the underlying host filesystem.

TL;DR

Authenticated Keycloak realm administrators with the 'manage-realm' role can exploit unvalidated file path handling in the java-keystore key provider to enumerate arbitrary files and directories on the underlying server filesystem via differential error responses.

Technical Details

Vulnerability Type: CWE-22: Path Traversal / Arbitrary Path Probing
Affected Component: JavaKeystoreKeyProviderFactory (java-keystore SPI)
Attack Vector: Network (Keycloak Admin REST API / UI)
Privileges Required: High ('manage-realm' role)
CVSS v3.1 Score: 4.9 Medium (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
EPSS Score: 0.78% (55.84th percentile)
Security Impact: Host filesystem enumeration and cross-realm keystore probing
CISA KEV Status: Not Listed

Affected Systems

Keycloak
Red Hat build of Keycloak
Keycloak: >= 26.6.0, < 26.6.4 (Fixed in: 26.6.4)
Keycloak: >= 26.4.0, < 26.4.13 (Fixed in: 26.4.13)
Red Hat build of Keycloak: >= 26.6, < 26.6.4-2 (Fixed in: 26.6.4-2)
Red Hat build of Keycloak: >= 26.4, < 26.4.13-1 (Fixed in: 26.4.13-1)

Code Analysis

Commit: 1bc0dd3

Restrict java keystore files to a realm folder (#703) Closes CVE-2026-9083

--- a/services/src/main/java/org/keycloak/keys/JavaKeystoreKeyProviderFactory.java
+++ b/services/src/main/java/org/keycloak/keys/JavaKeystoreKeyProviderFactory.java
@@ -127,8 +139,17 @@ public void validateConfiguration(KeycloakSession session, RealmModel realm, Com
                 .checkSingle(KEY_ALIAS_PROPERTY, true)
                 .checkSingle(KEY_PASSWORD_PROPERTY, true);

+        Path keystorePath = Paths.get(model.get(KEYSTORE_KEY)).normalize();
+        if (!keystorePath.isAbsolute()) {
+            keystorePath = this.keystoresPath.resolve(realm.getName()).resolve(keystorePath);
+        }
+        if (!keystorePath.startsWith(keystoresPath.resolve(realm.getName()))) {
+            throw new ComponentValidationException(String.format(
+                    "Keystore file '%s' is not under the realm directory '%s'", keystorePath, keystoresPath.resolve(realm.getName())));
+        }
+
         try {
-            KeyWrapper key = new JavaKeystoreKeyProvider(realm, model, session.vault()).loadKey(realm, model);
+            KeyWrapper key = new JavaKeystoreKeyProvider(keystoresPath, realm, model, session.vault()).loadKey(keystoresPath, realm, model);
             validateCertificateChain(key.getCertificateChain());
         } catch(GeneralSecurityException e) {

Mitigation Strategies

Upgrade Keycloak to a patched release that confines keystore paths to per-realm directories.
Enforce the Principle of Least Privilege by restricting the 'manage-realm' role to fully trusted administrators.
Isolate multi-tenant Keycloak instances or audit realm component creation logs for unexpected 'java-keystore' validation failures.

Remediation Steps:

Upgrade upstream Keycloak deployments to version 26.6.4 or 26.4.13, or upgrade Red Hat build of Keycloak to 26.6.4-2 or 26.4.13-1.
Create realm-specific subdirectories under the base keystores directory (by default ${kc.home.dir}/data/).
Relocate existing Java KeyStore (.jks, .p12, .bcfks) files into their respective realm subdirectories.
If using a non-default base directory, configure the startup parameter: kc.sh start --spi-keys--java-keystore--keystores-path /path/to/keystores.
Update the 'keystore' path attribute in each realm's java-keystore key provider configuration to reference the relocated file.

References

Read the full report for CVE-2026-9083 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community