CVE-2026-19729

MediumCVSS 4.9

Published: 09/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

41th percentile - higher than 41% of all known CVEs

Summary

A flaw in the key provider component of the keycloak-services library (core engine for Red Hat Build of Keycloak) arises from an incomplete fix for path probing. A realm administrator can still submit arbitrary filesystem paths as keystore parameters, allowing determination of file existence and readability on the server, potentially exposing sensitive system information.

Risk Assessment

The risk of exposing sensitive system information through file path probing by a realm administrator could compromise system confidentiality.

Recommendation

Apply the complete vendor patch and limit trust in realm administrators, while monitoring keystore-related activities.

Other vulnerabilities in keycloak-services

CVE-2025-8419Medium
A vulnerability was found in Keycloak-services where special characters used during email registration may perform SMTP Injection and unexpectedly send short unwanted emails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very short emails (subject and little data, the example is 60 chars). The only direct consequence is an unsolicited email being sent from the Keycloak server, but this could be a precursor for more sophisticated attacks.

Original NVD description (English source)

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS