CVE-2026-9083

ADVISORY - docker

Summary

Description

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

EPSS Score⁠: 0.00495 (0.387)

Common Weakness Enumeration (CWE)

ADVISORY - redhat

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impacted images

Advisories

Docker

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

CVE-2026-9083

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Package	Type	OS Name	OS Version	Affected Ranges	Fix Versions
keycloak	dhi	-	-	<26.6.4	26.6.4

Severity and metrics

No CVSS data available from this advisory.

Red Hat

CREATED

4 days ago

UPDATED

4 days ago

ADVISORY IDCVE-2026-9083⁠

EXPLOITABILITY SCORE

1.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-22⁠

CVSS SCORE

4.9medium