A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. (CVE-2026-19729)
Source GCVE Database
Not known to be exploited · CVSS 4.9 Medium : update affected systems when convenient.
Data as of 10/24/2026, 17:08:25 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NWhat to do
AI-suggested
Red Hat advises monitoring their advisory for updates. Since exploitation requires high-level privileges, restricting and monitoring realm administrator roles can reduce risk. Customers with a Technical Account Manager (TAM) can consult them for further guidance.
Description
A vulnerability in the key provider component of the keycloak-services library used by the Red Hat Build of Keycloak allows a realm administrator to submit arbitrary filesystem paths as keystore parameters. This flaw is due to an incomplete fix for path probing and can be exploited to check the existence and readability of files on the server, potentially exposing sensitive information. Exploitation requires high-level privileges (manage-realm role). No official patch or mitigation meeting Red Hat's criteria is currently available.
Impact
Successful exploitation allows an attacker with high-level administrative privileges to probe arbitrary filesystem paths on the host system, potentially exposing sensitive information by reading files that should not be accessible. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild. The attack complexity is low, but privileges required are high.