CVE-2026-19729 is a path traversal vulnerability (CWE-22) in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. A previous fix for path probing was incomplete, enabling a realm administrator to submit arbitrary filesystem paths as keystore parameters. This allows probing of the server's filesystem to determine file existence and readability, potentially exposing sensitive system information. The vulnerability requires high privileges to exploit and does not impact integrity or availability. Red Hat has assessed the severity as moderate with a CVSS v3.1 base score of 4.9. No patch or effective mitigation is currently available according to Red Hat's advisory.

Successful exploitation allows an attacker with high-level administrative privileges to probe arbitrary filesystem paths on the host system. This can lead to exposure of sensitive system information by confirming the existence and readability of files. There is no impact on integrity or availability, and no known exploits are reported in the wild. The vulnerability does not allow code execution or modification but can aid attackers in information gathering.

Red Hat currently does not provide a mitigation or patch that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Since exploitation requires high-level administrative privileges, restricting and auditing realm administrator access can reduce risk. No official fix is available at this time.