Medium severity · published Sep 9, 2026
CVE-2026-19729
Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters
4.9
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Keycloak 26.6 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19729
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19729
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:68276
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:68277
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:68278
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:68280
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-19729
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2515294
More from Red Hat build of Keycloak 26.4
9.8
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
9.1
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
9.1
CVE-2026-16443
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
8.8
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
8.8
CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
