CVE-2026-103884 describes a path traversal flaw in the X.509 client certificate authenticator component of Red Hat Build of Keycloak. When CRL Distribution Point checking is enabled, the server does not correctly validate file paths specified in client certificates. An attacker can exploit this by supplying a crafted certificate that causes the server to access arbitrary files on the local filesystem or consume excessive memory by loading large files, resulting in potential information disclosure or denial of service via system crash.

The vulnerability can lead to limited confidentiality impact through information disclosure of local files and high impact on availability due to potential system crashes from memory exhaustion. There is no indication of integrity impact. The CVSS score is 6.5 (medium severity), reflecting network attack vector with high attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-103884 for current remediation guidance. Until a fix is applied, consider disabling CRL Distribution Point checking if feasible, or restrict certificate sources to trusted entities to reduce exposure.