MEDIUMCVSS 4.9Vulnerability

CVE-2026-9083

### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

Properties

Severity
medium
Summary
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Cvss score
4.9
Retrieved at
2026-10-29T19:55:32+00:00
Ghsa published
2026-10-29T16:38:31Z
Source url
https://github.com/advisories/GHSA-9jrw-8xf7-xqhq
Ghsa updated
2026-10-29T16:38:34Z
Ghsa id
GHSA-9jrw-8xf7-xqhq
Last source
GitHub Advisory Database
Cve id
CVE-2026-9083
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
First seen by Signal
2026-10-29T19:55:32+00:00
Is ghsa only
false

Related Entities (3)

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-9083 (CVSS 4.9) — Ninja Signal Threat Intelligence | Ninja Signal