CVE-2026-16071 Overview
CVE-2026-16071 is an information disclosure vulnerability in the Keycloak LDAP storage provider. Keycloak federates user identities from external Lightweight Directory Access Protocol (LDAP) directories. The flaw allows a delegated administrator to perform LDAP searches using a Distinguished Name (DN) that references entries outside the configured search boundary. Missing validation on the DN lookup path exposes account information from unauthorized parts of the directory. The system also imports these out-of-scope users into local Keycloak storage. Red Hat has published advisories and patches covering affected Keycloak and Red Hat build of Keycloak distributions.
Critical Impact
A delegated administrator can read user account attributes from unauthorized directory branches and cause those users to be imported into local Keycloak storage, breaking tenant isolation.
Affected Products
- Keycloak (upstream) LDAP storage provider
- Red Hat build of Keycloak (see RHSA-2026:50846, 50847, 50848, 50849)
- Any deployment using Keycloak LDAP user federation with delegated administration
Discovery Timeline
- 2026-08-05 - CVE-2026-16071 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16071
Vulnerability Analysis
The vulnerability resides in the LDAP user federation component of Keycloak. Administrators configure a search base DN that scopes which subtree of the directory Keycloak may query. Delegated administrators, who typically have limited realm-level authority, can trigger a user lookup that supplies an arbitrary LDAP entry DN. The provider forwards this DN to the backend directory without confirming it falls under the configured search base. The directory returns matching attributes, which Keycloak surfaces to the delegated administrator and persists to its local user store. This behavior violates the tenant boundary that the search base setting is meant to enforce and turns Keycloak into a directory read channel for unauthorized subtrees.
Root Cause
The root cause is missing input validation on user-supplied DNs before they are used in LDAP search operations. The code path relies on the configured search base to restrict scope but does not verify that a requested DN is a descendant of that base. This is an authorization and input validation weakness closely aligned with improper access control on directory search parameters.
Attack Vector
Exploitation requires network access to a Keycloak administrative endpoint and valid delegated administrator credentials. The attacker issues a lookup or federated user search request with a DN pointing outside the intended subtree. Keycloak resolves the DN against the LDAP backend and returns account data. Repeated queries let the attacker enumerate users across the wider directory and populate the local Keycloak database with those identities.
No verified proof-of-concept code is published. See the Red Hat CVE analysis for CVE-2026-16071 and Red Hat Bug Report #2501720 for additional technical context.
Detection Methods for CVE-2026-16071
Indicators of Compromise
- Keycloak audit events showing successful LDAP user lookups with DNs that do not share the configured search base suffix.
- Unexpected new user entries in the Keycloak local database whose federated DN falls outside the configured LDAP search subtree.
- Bursts of USER_INFO_REQUEST or admin API user search calls from a single delegated administrator account.
Detection Strategies
- Parse Keycloak admin event logs and compare each federated lookup DN against the realm's configured LDAP usersDn value; flag any mismatches.
- Correlate LDAP server search logs with Keycloak service account activity to identify searches that reference DNs outside the sanctioned subtree.
- Review the USER_FEDERATION_MAPPER and user creation events for accounts imported at times not associated with normal provisioning workflows.
Monitoring Recommendations
- Enable Keycloak admin event logging with includeRepresentation set to true for realms that use LDAP federation.
- Forward Keycloak and LDAP directory logs to a centralized analytics platform and alert on out-of-scope DN patterns.
- Track the growth rate of federated users per realm and alert on sudden increases that may indicate mass import from unauthorized branches.
How to Mitigate CVE-2026-16071
Immediate Actions Required
- Apply the Keycloak updates referenced in RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849.
- Audit delegated administrator role assignments and remove privileges from accounts that do not require LDAP federation management.
- Review the local Keycloak user store for accounts imported from DNs outside the configured search base and remove unauthorized entries.
Patch Information
Red Hat has issued four advisories that address CVE-2026-16071 across supported Keycloak distributions: RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849. Upstream Keycloak users should update to a fixed release identified in the Red Hat CVE page for CVE-2026-16071.
Workarounds
- Restrict the LDAP bind account used by Keycloak so it can only read the intended subtree, enforcing scope at the directory server.
- Temporarily disable delegated administration for realms that use LDAP federation until patches are applied.
- Configure directory server access control lists to deny reads on branches outside the Keycloak-managed subtree.
# Example: restrict the LDAP service account to a specific subtree using OpenLDAP ACLs
# /etc/openldap/slapd.conf or cn=config equivalent
access to dn.subtree="ou=keycloak-users,dc=example,dc=com"
by dn.exact="cn=keycloak,ou=services,dc=example,dc=com" read
by * none
access to *
by dn.exact="cn=keycloak,ou=services,dc=example,dc=com" none
by * break
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
