Description
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4.9 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-server | <= 26.2.5 | — | GHSA-v897-pv23-r8cw |
Advisories 1
- WID-SEC-2026-0124 Keycloak: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jan 14, 2026
References
- RHSA-2026:2365 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-0976 vdb-entry
- RHBZ#2429869 issue-tracking