CVE-2026-16071 is a vulnerability in Keycloak's LDAP storage provider that arises from missing validation of LDAP Distinguished Names during delegated administrator searches. This lack of boundary validation permits lookups for users located outside the configured LDAP search boundary, resulting in unauthorized disclosure of user account details and unintended importing of those users into Keycloak's local storage. The vulnerability requires an attacker to have delegated administrative privileges and does not involve user interaction. It has a CVSS v3.1 base score of 5.4 (medium severity) with low confidentiality and integrity impacts and no availability impact. The root cause is the failure to ensure that requested LDAP DNs fall within the provider's configured search boundary.

Successful exploitation allows an attacker with delegated administrative privileges to disclose user account information from unauthorized LDAP organizational units and cause unintended user imports into the local Keycloak database. This could lead to unauthorized access to user data outside the intended LDAP search scope. The impact on confidentiality and integrity is low, and there is no impact on availability.

As of the current information, no explicit patch or fix version is provided. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Since exploitation requires delegated administrative privileges, restricting and monitoring delegated admin roles can reduce risk. Follow updates from Red Hat and Keycloak for forthcoming patches or official fixes.