{"id":"CVE-2026-19729","title":"A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak","summary":"A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm admini…","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"Red Hat","product":"keycloak-rhel9-container","affected":["keycloak-rhel9-container (all versions)","keycloak-rhel9-operator-container (all versions)","rhbk/keycloak-operator-bundle (all versions)","keycloak-services","rhbk-openshift-rhel9/rhbk-openshift-rhel9","keycloak-rhel9-container (all versions)","keycloak-rhel9-operator-bundle-container (all versions)","keycloak-rhel9-operator-container (all versions)","keycloak-services","rhbk-openshift-rhel9/rhbk-openshift-rhel9","keycloak-services"],"patched":["build_of_keycloak 26.4","build_of_keycloak 26.4.16","build_of_keycloak 26.6.7"],"published":"2026-09-09","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:17:10.540","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19729","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:68276","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68277","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68278","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68280","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19729","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515294","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19729.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19729"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19729"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00563,"epssPercentile":0.45598,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T17:59:10.749049Z"},"ingestedAt":"2026-09-09T08:04:11.992Z","slug":"CVE-2026-19729","body":"## Overview\n\nA flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Build of Keycloak · no fix planned: Red Hat Build of Keycloak · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19729.json)\n- **RHSA-2026:68276** · Red Hat · fixed in: Red Hat build of Keycloak 26.4 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68276)\n- **RHSA-2026:68280** · Red Hat · fixed in: Red Hat build of Keycloak 26.4.16 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68280)\n- **RHSA-2026:68278** · Red Hat · fixed in: Red Hat build of Keycloak 26.6.7 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68278)\n- **RHSA-2026:68277** · Red Hat · fixed in: Red Hat build of Keycloak 26.6 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68277)","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}