CVE-2026-103884: Keycloak Path Traversal Vulnerability

CVE-2026-103884 Overview

CVE-2026-103884 is a path traversal vulnerability [CWE-22] in the X.509 client certificate authenticator of Keycloak. The flaw affects deployments where Certificate Revocation List (CRL) Distribution Point checking is enabled. The server fails to properly validate file paths embedded in a client certificate. An attacker can submit a crafted certificate that forces the server to read arbitrary local files or load oversized files into memory. Successful exploitation leads to information disclosure or service unavailability through memory exhaustion.

Critical Impact
Unauthenticated attackers can trigger local file reads or crash the Keycloak server by presenting a malicious X.509 client certificate.

Affected Products

Red Hat Keycloak (see vendor advisory for impacted builds)
Red Hat Build of Keycloak
Red Hat Single Sign-On based deployments

Discovery Timeline

2026-10-01 - CVE CVE-2026-103884 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103884

Vulnerability Analysis

The vulnerability resides in Keycloak's X.509 client certificate authenticator. When administrators enable CRL Distribution Point validation, the authenticator extracts distribution point values from the presented certificate and attempts to retrieve the referenced CRL. The code path accepts file-based references without constraining them to expected locations or formats. A malicious certificate can therefore steer the server toward sensitive files on the local filesystem or toward unusually large files intended to consume heap memory.

The EPSS score of 0.213% reflects limited observed exploitation activity, but the attack surface is reachable before authentication completes. Any Keycloak realm that trusts external certificate authorities for client authentication and enforces CRL checking is exposed.

Root Cause

The root cause is insufficient input validation of CRL Distribution Point URIs embedded in client certificates. The authenticator treats attacker-controlled certificate fields as trusted path or URI inputs. There is no allowlist of acceptable schemes, no size limit on retrieved resources, and no canonicalization check preventing directory traversal.

Attack Vector

Exploitation requires network access to the Keycloak authentication endpoint and a realm configured for X.509 client authentication with CRL checking enabled. The attacker generates a self-signed or chain-signed certificate containing a crafted CRL Distribution Point extension. When Keycloak processes the authentication request, it parses the extension and attempts to open the attacker-specified resource. Depending on the payload, the server reads a sensitive local file or begins loading a very large file until memory is exhausted and the process becomes unresponsive.

No verified public proof-of-concept code is available. Technical details are described in the Red Hat CVE-2026-103884 Advisory.

Detection Methods for CVE-2026-103884

Indicators of Compromise

Keycloak authentication logs showing X.509 authentication attempts with unusual CRL Distribution Point values referencing file:// URIs or local paths.
Server process memory spikes or out-of-memory errors correlated with inbound X.509 authentication requests.
Unexpected file read activity by the Keycloak JVM process targeting paths outside its install or data directories.

Detection Strategies

Enable verbose logging on the X.509 authenticator and inspect the parsed CRL Distribution Point fields for non-HTTP(S) schemes.
Monitor Keycloak host filesystem telemetry for reads of sensitive files such as /etc/passwd, /etc/shadow, or Keycloak configuration files initiated by the authentication service.
Correlate authentication failures from X.509 flows with simultaneous JVM heap growth or garbage collection pressure.

Monitoring Recommendations

Alert on repeated failed X.509 client authentication attempts from a single source IP within short time windows.
Track Keycloak process resource usage and flag sudden heap allocation above baseline during authentication events.
Forward Keycloak event and server logs to a centralized analytics platform for retention and correlation.

How to Mitigate CVE-2026-103884

Immediate Actions Required

Apply the Keycloak patch referenced in the Red Hat CVE-2026-103884 Advisory as soon as it is available for your distribution.
Audit all realms for X.509 client certificate authentication configuration and identify where CRL Distribution Point checking is enabled.
Restrict network access to Keycloak authentication endpoints that accept client certificates to known client networks.

Patch Information

Red Hat has published advisory information for CVE-2026-103884. Review the Red Hat CVE-2026-103884 Advisory for fixed package versions covering Red Hat Build of Keycloak and Red Hat Single Sign-On. Upstream Keycloak users should upgrade to the first release incorporating the fix.

Workarounds

Disable CRL Distribution Point checking in the X.509 authenticator configuration and rely on OCSP or a locally managed CRL file where feasible.
Configure the authenticator to use a static, administrator-controlled CRL path instead of extracting the distribution point from the client certificate.
Run Keycloak under a restricted operating system user with filesystem permissions scoped to its install directory to limit the impact of arbitrary file reads.

bash

# Example: disable CRL distribution point checking in a Keycloak X.509 authenticator flow
# via kcadm.sh (adjust IDs for your realm and execution)
kcadm.sh update authentication/executions/<EXECUTION_ID> \
  -r <REALM> \
  -s 'config."x509-cert-auth.crl-checking-enabled"=false' \
  -s 'config."x509-cert-auth.crldp-checking-enabled"=false'