CVE-2026-107121: Keycloak STARTTLS Information Disclosure

CVE-2026-107121 Overview

CVE-2026-107121 affects the keycloak-services component in Red Hat Keycloak. The flaw resides in SMTP email configuration handling. When administrators enable STARTTLS, Keycloak does not strictly enforce the encrypted channel. An attacker positioned on the network path can tamper with the STARTTLS negotiation and force the connection to fall back to cleartext. This downgrade exposes SMTP credentials and the full content of outbound email messages. The weakness is categorized under CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
An on-path attacker can strip STARTTLS from Keycloak's SMTP connections, capturing mail server credentials and email contents, including password reset and verification tokens, in plaintext.

Affected Products

Red Hat Keycloak (keycloak-services component)
Keycloak deployments configured with SMTP STARTTLS for outbound email
Downstream Red Hat Build of Keycloak distributions

Discovery Timeline

2026-10-07 - CVE-2026-107121 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-107121

Vulnerability Analysis

Keycloak uses SMTP to deliver account verification messages, password reset links, one-time passwords, and administrative notifications. The keycloak-services component exposes a STARTTLS toggle in its SMTP configuration. When enabled, the client is expected to require successful TLS negotiation before transmitting authentication data or message content.

The implementation treats STARTTLS as opportunistic rather than mandatory. If the STARTTLS handshake fails or the server response is manipulated to indicate the extension is unavailable, Keycloak proceeds over the plaintext channel. The client does not abort the session when encryption cannot be established.

A network-positioned attacker can rewrite the server's EHLO response to strip the STARTTLS capability, or return an error to the client's STARTTLS command. Keycloak then transmits the SMTP AUTH sequence and DATA payload in cleartext. Captured credentials permit relay abuse, and intercepted messages leak reset tokens that enable account takeover.

Root Cause

The root cause is missing enforcement of the negotiated security policy. The STARTTLS option configures an intent to upgrade the connection but the SMTP client code lacks a hard check that TLS was actually established before continuing. This is a classic STRIPTLS downgrade pattern tracked under CWE-319.

Attack Vector

Exploitation requires a network attacker with the ability to intercept and modify traffic between Keycloak and the configured SMTP relay. Common positions include compromised intermediate routers, rogue Wi-Fi, or ARP and BGP hijacks within shared infrastructure. The attacker intercepts the SMTP session, suppresses the STARTTLS advertisement, and records the resulting cleartext stream. See the Red Hat CVE-2026-107121 Advisory for additional context.

Detection Methods for CVE-2026-107121

Indicators of Compromise

Outbound SMTP sessions from Keycloak hosts that complete AUTH LOGIN or AUTH PLAIN without a preceding successful STARTTLS command.
SMTP server logs showing plaintext authentication from Keycloak service accounts when policy requires TLS.
Unexpected EHLO responses on the wire that omit the STARTTLS capability for a known TLS-capable relay.

Detection Strategies

Inspect network traffic on TCP/25, 465, and 587 originating from Keycloak nodes and alert on cleartext AUTH sequences.
Correlate Keycloak email-sent audit events with SMTP relay TLS session logs to identify sessions missing TLS.
Deploy TLS visibility on egress gateways to flag STARTTLS strip patterns, including mismatched EHLO capability sets.

Monitoring Recommendations

Enable detailed SMTP logging on the mail relay and alert when connections from Keycloak service identities arrive unencrypted.
Monitor Keycloak server logs for SMTP exceptions and TLS negotiation warnings that may indicate active tampering.
Track egress traffic baselines from Keycloak hosts to detect anomalous SMTP endpoints introduced by routing manipulation.

How to Mitigate CVE-2026-107121

Immediate Actions Required

Apply the vendor update once published; track status via the Red Hat CVE-2026-107121 Advisory and Red Hat Bug Report #2547296.
Rotate SMTP credentials used by Keycloak if plaintext exposure is suspected.
Switch the SMTP realm configuration to implicit TLS on port 465 where the relay supports it, avoiding the STARTTLS upgrade path entirely.

Patch Information

Red Hat has published tracking for this flaw under the advisory and bug entries referenced above. Review the advisory for the fixed keycloak-services version and apply the update to all Keycloak and Red Hat Build of Keycloak instances. Restart the Keycloak service after upgrading and verify SMTP functionality against a test relay that enforces TLS.

Workarounds

Configure the SMTP relay to require TLS and reject plaintext AUTH, which forces session failure instead of credential leakage.
Restrict Keycloak egress to a dedicated, trusted mail relay reachable only over an internal network segment that an external attacker cannot intercept.
Use mutual TLS or an authenticated VPN tunnel between Keycloak and the SMTP relay to eliminate on-path tampering.

bash

# Example: force implicit TLS (SMTPS) in Keycloak SMTP realm configuration
# Replace STARTTLS on port 587 with SMTPS on port 465
kcadm.sh update realms/<realm> -s 'smtpServer.host=smtp.example.com' \
  -s 'smtpServer.port=465' \
  -s 'smtpServer.ssl=true' \
  -s 'smtpServer.starttls=false' \
  -s 'smtpServer.auth=true'