CVE-2026-0976: Keycloak Path Traversal Vulnerability

CVE-2026-0976 Overview

A flaw was found in Keycloak involving improper input validation of RFC-compliant matrix parameters in URL path segments. While Keycloak accepts these matrix parameters, common reverse proxy configurations may ignore or mishandle them, creating a security gap. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

Critical Impact

Attackers may bypass reverse proxy access controls to reach sensitive or administrative Keycloak endpoints that were intended to be restricted, potentially leading to unauthorized access to identity management functions.

Affected Products

• Keycloak (specific versions not disclosed in advisory)

Discovery Timeline

• 2026-01-15 - CVE-2026-0976 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-0976

Vulnerability Analysis

This vulnerability stems from a discrepancy in how Keycloak and reverse proxies handle RFC-compliant matrix parameters in URL paths. Matrix parameters are a lesser-known URL feature defined in RFC 3986 that allows key-value pairs to be embedded within path segments using semicolons (e.g., /path;param=value/resource).

Keycloak properly parses and processes these matrix parameters according to RFC specifications. However, many reverse proxies (such as nginx, Apache, or cloud load balancers) either strip, ignore, or misinterpret these parameters when performing path-based access control decisions. This creates a bypass vector where an attacker can craft URLs that appear innocuous to the proxy but resolve to restricted endpoints within Keycloak.

The vulnerability is classified under CWE-20 (Improper Input Validation), as the core issue lies in the inconsistent handling of input between different components in the request chain.

Root Cause

The root cause is the inconsistent interpretation of matrix parameters between Keycloak and upstream reverse proxies. When organizations deploy Keycloak behind a reverse proxy and configure path-based access restrictions (e.g., blocking /admin/*), attackers can potentially embed matrix parameters to obfuscate the actual path being accessed. For example, a request to /admin;ignored=value/console might bypass a proxy rule blocking /admin/ while still being interpreted by Keycloak as a request to the admin console.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can remotely craft malicious HTTP requests containing matrix parameters designed to bypass proxy-level path filtering. The attack complexity is considered high because successful exploitation depends on specific proxy configurations and the attacker's knowledge of the target environment's architecture.

Example attack scenario:

1. An organization deploys Keycloak behind nginx with a rule blocking direct access to /auth/admin/*
2. An attacker crafts a request such as /auth;matrix=bypass/admin/console
3. The nginx proxy evaluates the path as /auth;matrix=bypass/admin/console which doesn't match the blocking rule
4. Keycloak receives the request and processes it as access to the admin console
5. The attacker gains access to an endpoint that should have been restricted

For detailed technical analysis, refer to the Red Hat CVE-2026-0976 Advisory and Red Hat Bug Report #2429869.

Detection Methods for CVE-2026-0976

Indicators of Compromise

• HTTP requests containing semicolons (;) in URL path segments before sensitive endpoints
• Unusual URL patterns in access logs showing matrix parameter syntax (e.g., /path;param=value/)
• Access to administrative endpoints from unexpected source IPs or without expected authentication flows
• Log entries showing successful access to restricted paths that should have been blocked by proxy rules

Detection Strategies

• Configure web application firewalls (WAF) to flag or block requests containing semicolons in URL path segments
• Implement logging and alerting for requests with matrix parameter patterns targeting sensitive endpoints
• Audit reverse proxy logs for discrepancies between blocked and allowed requests to Keycloak admin paths
• Deploy SentinelOne Singularity to detect anomalous access patterns and potential bypass attempts in real-time

Monitoring Recommendations

• Enable verbose access logging on both the reverse proxy and Keycloak to capture full request URIs
• Set up alerts for access to administrative endpoints (/admin/*, /auth/admin/*) from external networks
• Monitor for authentication events on admin interfaces that don't correlate with expected administrator activity
• Regularly review proxy and Keycloak logs for unusual URL encoding or parameter patterns

How to Mitigate CVE-2026-0976

Immediate Actions Required

• Review and update reverse proxy configurations to normalize URLs before applying path-based access rules
• Configure the reverse proxy to strip or reject matrix parameters in URL paths before forwarding requests
• Implement defense-in-depth by adding authentication requirements directly within Keycloak for administrative endpoints
• Consider network-level restrictions to limit admin interface access to specific trusted IP ranges

Patch Information

Red Hat has acknowledged this vulnerability and is tracking it. Organizations should monitor the Red Hat CVE-2026-0976 Advisory for patch availability and updated guidance. Apply vendor patches as soon as they become available for your Keycloak deployment.

Workarounds

• Configure reverse proxies to decode and normalize URLs before applying access control rules
• Block requests containing semicolons in path segments at the WAF or proxy level if matrix parameters are not needed
• Restrict admin endpoint access to internal networks only using firewall rules
• Enable additional authentication mechanisms (MFA) for administrative access regardless of network path

# Example nginx configuration to reject requests with matrix parameters
# Add to server or location block
if ($request_uri ~* ";") {
    return 403;
}

# Alternative: Normalize URIs before processing
# This requires the ngx_http_rewrite_module
set $clean_uri $request_uri;
if ($clean_uri ~* "^([^;]*);[^/]*(/.*)$") {
    return 403;
}