CVE-2026-16100 is a vulnerability in Keycloak where the user-event metrics system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages may contain user-controlled input such as nonexistent client IDs, an authenticated user with account management permissions can generate a large number of unique metric entries. This unbounded metric cardinality can exhaust system memory, leading to denial of service by crashing or making the service unavailable. The vulnerability arises from the use of unsanitized, request-controlled input within Prometheus metric labels. The Red Hat Product Security team assessed this vulnerability as Moderate severity with a CVSS 3.1 base score of 6.5, noting that exploitation requires authenticated access with specific permissions. No official fix or patch is currently available according to the Red Hat advisory, and mitigation options are limited or do not meet criteria for ease of use or applicability.

Successful exploitation allows an authenticated user with specific account management permissions to cause a denial of service by exhausting system memory. This results in the Keycloak service crashing or becoming unavailable. There is no impact on confidentiality or integrity, only availability is affected.

According to the Red Hat advisory, no mitigation or official fix is currently available that meets criteria for ease of use, deployment, or applicability. Users should monitor vendor advisories for updates. Since exploitation requires authenticated access with specific permissions, restricting such access may reduce risk. Consider disabling metrics if feasible until a fix is available.