CVE-2026-16100 Overview
CVE-2026-16100 is a resource exhaustion vulnerability in Keycloak's user-event metrics recording subsystem. When the metrics feature is enabled, Keycloak records raw error messages from failed account operations as Prometheus metric labels. These error messages incorporate user-supplied input, such as nonexistent client identifiers, without cardinality controls. An authenticated attacker can trigger a large volume of failed operations using unique inputs to generate unbounded metric label combinations. The resulting metric explosion consumes system memory until the Keycloak service crashes or becomes unresponsive. This flaw is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling).
Critical Impact
An authenticated user can exhaust server memory and crash Keycloak by triggering failed operations with unique client identifiers.
Affected Products
- Red Hat build of Keycloak (see RHSA-2026:50848)
- Red Hat build of Keycloak (see RHSA-2026:50849)
- Upstream Keycloak deployments with metrics enabled
Discovery Timeline
- 2026-08-05 - CVE-2026-16100 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-16100
Vulnerability Analysis
Keycloak exposes operational telemetry through a Prometheus-compatible metrics endpoint. When user-event metrics are enabled, the platform records account-operation outcomes and attaches contextual labels to each metric series. The flawed implementation includes raw error message strings among these labels. Error messages carry attacker-controlled data such as invalid client IDs, which produces a distinct metric time series for every unique input value. Prometheus metric backends store each label combination in memory, so unbounded label cardinality translates directly into unbounded memory allocation.
Root Cause
The root cause is the absence of input sanitization and cardinality limits on metric label values. Keycloak treats untrusted error-message content as trusted telemetry context. The design violates the Prometheus guidance that label values must belong to a bounded set. Because failed account operations are reachable by any authenticated user, the exposure scales with any account that can submit account API requests.
Attack Vector
Exploitation requires network access and authenticated low-privilege credentials. The attacker repeatedly issues account operations that reference nonexistent or malformed client IDs. Each request produces a failed event with a unique error message, which Keycloak records as a new metric series. Iterating through a large set of pseudo-random client IDs inflates the internal metric registry until the Java Virtual Machine exhausts its heap. The service then throws OutOfMemoryError conditions, halts request processing, and becomes unavailable to legitimate users. Additional technical context is available in the Red Hat CVE analysis and Red Hat Bugzilla #2501730.
Detection Methods for CVE-2026-16100
Indicators of Compromise
- Rapid growth in the size of the /metrics endpoint response payload or the number of unique metric series exported by Keycloak.
- Repeated failed account-operation events from a single authenticated principal referencing many distinct nonexistent client IDs.
- Keycloak JVM heap usage climbing steadily without a corresponding increase in legitimate request volume.
- OutOfMemoryError entries in Keycloak server logs followed by container or pod restarts.
Detection Strategies
- Monitor the cardinality of Prometheus label sets produced by Keycloak and alert when unique series counts exceed a defined baseline.
- Correlate authentication audit events with metric-endpoint size to identify users driving abnormal label growth.
- Baseline the ratio of failed to successful account operations per user and flag statistical outliers.
Monitoring Recommendations
- Instrument the Keycloak JVM with heap and garbage-collection telemetry, and alert on sustained old-generation growth.
- Track error-message diversity in the user-event stream and surface accounts generating high entropy inputs.
- Forward Keycloak audit logs and container restart events to a centralized SIEM for correlation with metric anomalies.
How to Mitigate CVE-2026-16100
Immediate Actions Required
- Apply the fixed Keycloak packages published in RHSA-2026:50848 and RHSA-2026:50849.
- If patching is not immediately possible, disable the user-event metrics feature until the update is applied.
- Restrict network access to the Keycloak account API to trusted clients and enforce rate limiting on failed operations.
- Rotate or review credentials for low-privilege accounts that can reach the account API.
Patch Information
Red Hat has released fixed builds through advisories RHSA-2026:50848 and RHSA-2026:50849. The upstream fix constrains metric label values so that raw error messages are no longer emitted as high-cardinality labels. Consult the Red Hat CVE page for build-specific version identifiers.
Workarounds
- Disable user-event metrics collection in the Keycloak configuration until the patched version is deployed.
- Place a reverse proxy in front of Keycloak that rate limits repeated failed account-operation requests per authenticated user.
- Enforce strict JVM heap limits and configure automatic pod restarts to reduce the blast radius of memory exhaustion.
- Restrict scraping of the /metrics endpoint to internal monitoring networks to reduce reconnaissance of label growth.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
