CVE-2026-19729 Overview
CVE-2026-19729 is a path traversal vulnerability in the key provider component of the keycloak-services library, the core engine of the Red Hat Build of Keycloak. A prior fix for path probing was incomplete, allowing a realm administrator to submit arbitrary filesystem paths as keystore parameters. An authenticated attacker with realm administrator privileges can use this behavior to probe the server filesystem and infer the existence and readability of files. The flaw is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
A realm administrator can enumerate sensitive files on the Keycloak server, potentially exposing configuration data, credentials, or private keys used elsewhere on the host.
Affected Products
- Red Hat Build of Keycloak
- keycloak-services library (key provider component)
- Deployments relying on the prior incomplete path-probing fix
Discovery Timeline
- 2026-09-09 - CVE-2026-19729 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-19729
Vulnerability Analysis
The flaw resides in the key provider logic inside keycloak-services, which accepts keystore file paths as configuration parameters when a realm administrator defines or updates key providers. A previous patch attempted to constrain these paths, but the validation was incomplete. An attacker with realm administrator privileges can submit arbitrary filesystem paths and observe the server's response to determine whether a file exists and whether the Keycloak process can read it. This provides an oracle for filesystem reconnaissance, even though the file contents themselves are not directly returned. The vulnerability is exploitable over the network through the standard administrative interfaces exposed by Keycloak.
Root Cause
The root cause is insufficient input validation on keystore path parameters processed by the key provider. The earlier remediation did not fully normalize or restrict the accepted path values, leaving path traversal sequences and absolute paths reachable. Because the code differentiates between missing, unreadable, and readable files through distinct error handling, the server behavior effectively leaks state about the underlying filesystem.
Attack Vector
Exploitation requires an authenticated realm administrator account and network access to the Keycloak administration API or console. The attacker configures a key provider and supplies a crafted keystore path such as /etc/shadow, /proc/self/environ, or paths under application data directories. The server's differing responses to valid, invalid, and inaccessible paths let the attacker map the filesystem and identify sensitive resources for follow-on attacks. No user interaction is required, and the attack does not affect integrity or availability of the service.
No public proof-of-concept code is available. See the Red Hat CVE-2026-19729 Advisory and Red Hat Bug Report #2515294 for vendor technical details.
Detection Methods for CVE-2026-19729
Indicators of Compromise
- Realm administrator activity that creates or updates key providers with keystore paths pointing outside expected Keycloak data directories.
- Audit log entries showing repeated key provider configuration changes referencing system paths such as /etc/, /root/, /proc/, or user home directories.
- Unusual sequences of failed key provider validations from the same administrator account within a short time window.
Detection Strategies
- Review Keycloak admin event logs for KEY_PROVIDER create and update events and inspect the submitted keystore parameter values.
- Alert on any keystore path value that is absolute, contains .., or resolves outside the Keycloak configuration directory.
- Correlate administrative API calls with process-level file access telemetry on the Keycloak host to identify probing patterns.
Monitoring Recommendations
- Forward Keycloak admin and system events to a centralized logging or SIEM platform and retain them for post-incident analysis.
- Monitor file access attempts by the Keycloak service account against sensitive files such as /etc/shadow, private key stores, and cloud credential files.
- Track changes to realm administrator role assignments and flag new accounts granted realm-admin privileges.
How to Mitigate CVE-2026-19729
Immediate Actions Required
- Apply the latest Red Hat Build of Keycloak security update as soon as it is available for your supported version.
- Audit all accounts that hold realm administrator privileges and remove any that are no longer required.
- Review recent key provider configuration changes for suspicious keystore path values and revert unauthorized entries.
Patch Information
Refer to the Red Hat CVE-2026-19729 Advisory for the authoritative list of fixed packages, affected product versions, and errata references. The Red Hat Bug Report #2515294 tracks the upstream remediation of the incomplete path validation in the key provider component.
Workarounds
- Restrict administrative console and API network exposure so that only trusted management networks can reach Keycloak.
- Run the Keycloak service under a dedicated low-privilege OS account with filesystem access limited to its own configuration and data directories.
- Use mandatory access controls such as SELinux or AppArmor to deny the Keycloak process read access to sensitive system files.
- Enforce strong authentication, including phishing-resistant multi-factor authentication, for all realm administrator accounts.
# Configuration example: restrict Keycloak filesystem access with systemd
# /etc/systemd/system/keycloak.service.d/hardening.conf
[Service]
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/keycloak /var/log/keycloak
InaccessiblePaths=/etc/shadow /root /home
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
